Hot answers tagged

47

I try to provide a brief intro. ABE Attribute-based encryption (ABE) is a relatively recent approach that reconsiders the concept of public-key cryptography. In traditional public-key cryptography, a message is encrypted for a specific receiver using the receiver’s public-key. Identity-based cryptography and in particular identity-based encryption (IBE) ...


9

I am just going to answer regarding identity-based encryption (IBE): I don't know much about the situation for attribute-based encryption. Also, I am just answering based on today's situation: recent IBE constructions may prove to be very efficient (or not) in the future, and if you want to consider only post-quantum schemes you will have to discard IBEs ...


8

I purposefully did not look at the details of the change you are proposing because whatever the change is, the answer is a resounding YES. If you make any change to a cryptographic construction, then you must prove the security of the modified scheme. If you are lucky, you may be able to reduce the security of the modified scheme to the original scheme, or ...


5

In real world applications Attribute-based Encryption (ABE) is used in conjunction with a symmetric cipher, because you can only encrypt group elements with ABE. In this case it is the multiplicative group $G_T$. The number of bits is limited when you try to represent text messages (bit strings) with a group element, because the size of the group is derived ...


5

There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write it additively $e(aP,bQ)=e(P,Q)^{ab}$. This comes from the fact that in $e : \mathbb{G}_1\times \mathbb{G}_2\to\mathbb{G}_T$, $\mathbb{G}_1$ and $\mathbb{G}_2$ ...


4

I believe the answer cygnusv gave is not fully correct. If an object is tagged with "NUCLEAR, TOPSECRET" it can potentially be decrypted by someone not having the TOPSECRET attribute (or NUCLEAR attribute). Why? Because it all depends on the structure of the private keys in the system. A private key could for example be: "NUCLEAR or SCIENCE LAB A". Thus it ...


4

Let's assume that we're talking about monotonic access structures (without negated attributes in the policy). A Threshold policy was introduced in Sahai, Amit, and Brent Waters. "Fuzzy identity-based encryption." Advances in Cryptology–EUROCRYPT 2005. Springer Berlin Heidelberg, 2005. 457-473. (link) It means that a user secret key and the ciphertext are ...


4

I suggest, you look into the code how that works. Basically, you start with a secret that you want to share according to some tree. You share the secret with a Threshold Secret Sharing Scheme like Shamir's Secret Sharing and put the resulting shares into the children of that node (in the beginning this is the root node). Then you can re-share each of the ...


3

Collusions are not possible here since each user's private keys are randomized. As you can see in the Key Generation function, for each user a random value $r$ is generated and embedded into all his private keys. Therefore, if you try to use private keys from different users, you will not be using the same random $r$ during the decryption process, so it will ...


3

The first Attribute-based Encryption scheme was introduced by Sahai and Waters in 2005: Fuzzy Identity-Based Encryption. It worked by associating a set of attributes with both the ciphertext and the private key of the user. Take for example the ciphertext which is encrypted with the attribute set $\{A, B, C\}$ and the private key of some user with the ...


3

It is related to Cloud storage in the sense that you don't have to trust the server you put your data on. Usually, the access control is done via authentication. This requires the server to be trusted. However in the case of Cloud storage, you don't know anything about the server hosting the data, so being able to do access control with the encryption ...


3

There are ways to prevent Bob from having complete control over the randomness pool. You could use some form of verified randomness, where your function $f$ checks that the random string is signed before executing. This would work using, for instance, the NIST randomness beacon. You could also contain within $f$ a PRNG, so Bob does not need to provide all ...


3

The BSW07 CP-ABE scheme is a pairing based construction. Denoting the pairing as $e:G\times G\rightarrow G_T$ (symmetric notation for simplicity), the message space of this scheme is the prime order $q$ group $G_T$, which in practice is a prime order $q$ subgroup of the multiplicative group of some finite field. Consequently, if you have a message $m$ and ...


3

With IBE the public key is a public bitstring as your email. A Key-authority issues a secret key that is tied with this public key.The owner of the secret key can only decrypt. ABE entails more complex access control on decryption operation such as:"Only the owner of the secret key that corresponds to: Area:=Italy AND Age:<30 and Business:=Researcher" ...


3

My understanding of this is as follows: Monotonic access structure: if $\mathbb{A}$ is a set of attributes satisfying an access structure $T$, then any $\mathbb{A}'$ such that $\mathbb{A} \subset \mathbb{A}'$ also satisfies $T$. For example, consider $T = A \cap B$, then both $\mathbb{A}=\{A,B\}$ and $\mathbb{A}'=\{A,B,C\}$ satisfy $T$. Non-monotonic ...


3

This is a bilinear pairing used in cryptography. More precisely it's an evaluation of an appropriate pairing friendly elliptic curve equation.(1,2,3,4,5)


3

CP-ABE fits naturally with RBAC, whereas KP-ABE not so much. Better analogies can be made if you think of attributes as "tags" of the encrypted object/document, instead of the users. For instance, imagine a confidential document about nuclear weapons which is encrypted under the attributes NUCLEAR and TOPSECRET. Then, only a user with a key for attributes ...


3

I have a question about multiplication of two points belong to elliptic curve. I know every think about adding and scalar multiplication but not about multiplication of two points. Actually, when the paper talks about 'multiplying' two points, it's talking about what we more conventionally call 'point addition'; and hence what they call "g to the power to ...


3

ABE provides a secure and automatic way to enforce access control, but access control may not involve encryption. In the ABE setting, the resources (that one wants to access) are encrypted by a "controller" and then the ciphertexts are made public and each user is granted a key corresponding to its specific access right. Then, the controller doesn't need ...


2

Surely bilinearity helps and and you have to be aware of the fact that $e(g^a,g^b)\cdot e(g^a,g^{-b})=e(g^a,g^b)\cdot e(g^a,g^b)^{-1}=1$. You see that from your last equation $$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$ you get $$=e(g^{a\...


2

If you need something that already exists, have a look at the advanced Crypto software collection and specifically cpabe — which implements ciphertext-policy attribute-based encryption scheme that uses C and PBC library for pairings.


2

I think you have a lack of knowledge on pairings and finite fields. Your definition of the pairing $e(X,Y)=g^{XY} \bmod p$ is not correct. A pairing is defined as a map $e : \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$ with the property \begin{align}\text{for all }g_1 \in \mathbb{G}_1 \text{ and } g_2 \in \mathbb{G}_2: e(g_1^a,g_2^b) = e(g_1,g_2)^{ab}\...


2

Simply speaking, if any superset of the set satisfying the access structure satisfies the access structure, we call the structure monotonic. Let $\{1,2,...,n\}$ be a set of indices. An access structure is a collection $\mathbb{A}$ of non-empty subsets of $\{1,2,3,...,n\}$. We say a collection (or an access structure) $\mathbb{A} \subseteq 2^{\{1,2,...,n\}}$ ...


2

Layering your encryption mechanisms like that would not display collusion-resistance between the two schemes. For example, someone with an Org-A key could decrypt the outer encryption over a record designated for Org-A administrators and then pass the inner ciphertext to someone with an Administrator key. Of course, you could use a different key for each Org'...


2

At first, the abbreviation “ABBE” is used by Zhou et al. in [2] as a name for his ABE scheme. Zhou builds on top of a CP-ABE scheme which in addition supports “constant” ciphertexts (named CCP-ABE). From this perspective ABBE is a specific ABE scheme based on CP-ABE supporting constant ciphertexts. However, in a more general way, I see ABE in the context of ...


2

Since $H$ is a hash that projects into $\mathbb{G}_0$, one must be able to write $H(i)$ as $g^z$ for some unknown $z$, because $g$ is a generator of $\mathbb{G}_0$. \begin{eqnarray*} \text{DecryptNode(CT,SK,}x\text{)} & = & \frac{e(D_i, C_x)}{e(D^{'}_i, C^{'}_x)} \\ & = & \frac{e(g^r\cdot H(i)^{r_i}, g^{q_x(0)})}{e(g^{r_i}, H(i)^{q_x(0)})} \\...


2

Given your answer to my comment, I'll try to give you an intuition about why simulators are used in cryptographic proofs (but as already mentioned, I cannot help much for the particular case of ABE). Disclaimer: this will be a very (very) informal explanation Imagin two players, Alice and Bob, performing some cryptographic protocol. Alice has an input $a$, ...


2

It means exactly what is written, the advantage of the adversary is a quantity which is defined as the difference between the probability that $b = b'$ and $1/2$. For example if the probability that $b = b'$ is $3/4$, then the advantage of the adversary is $3/4-1/2 = 1/4$.


2

1) Is it correct to assume that in this scheme there is only one public key? Private keys are generated based on one's attributes that I do understand, by the authority. No, each attribute is a public key. When you are encrypting a message, you form the access policy using the public keys of the various attributes needed from your policy. 2) If above ...


2

I can discern two cases here: A strict hierarchy A partial hierarchy Using 1, "Hierarchical access control" as a term used with encryption implies that some users have more decryption power than others. Especially in access control modelling, hierarchy is usually "strict". This means that if A > B (A is "higher", and has "more" decryption power than B) ...


Only top voted, non community-wiki answers of a minimum length are eligible