4.5 ANOBE from Attribute-Based Encryption
4.5.1 Generic constructions for ANOBE from ABE
This section is dedicated to formalizing the relation between ABE and BE. To this end, we provide generic ways to achieve BE (and in particular ANOBE) from both flavours of ABE, namely ciphertext-policy ABE (CP-ABE) and key-policy ABE (KP-ABE). While it is fairly natural to think of a BE scheme as a CP-ABE scheme whose ciphertext policy is set-membership, it is perhaps not so intuitive to see BE as arising as a special instance of KP-ABE.
We explore these ideas next, giving first some intuition and then the detailed constructions and proofs.
BE and CP-ABE. Let U be the universe of users of the desired BE scheme. We consider a CP-ABE scheme whose universe of attributes is precisely U. Being user i will translate to having attribute i. Furthermore, belonging to the target broadcast set S will correspond to a set-membership policy. This can be expressed as a disjunction of attributes, i.e. users. It is then very intuitive to think of a BE scheme as a CP-ABE scheme with the above-mentioned encryption policy.
More formally, let Γ = (CPABE.PG,CPABE.Setup, CPABE.KeyGen,CPABE.Enc,
CPABE.Dec) be a CP-ABE scheme which efficiently supports disjunction policies.
LetU be the universe of attributes, where|U|=n. We will construct a BE scheme from Γ, having U as the universe of users and the same message and ciphertext space, in the following way:
BE.PG(1λ, n): RunCP
ABE.PGon input 1λand returnpars, which implicitly contain nand a description of the message spaceMsgSpand the ciphertext spaceCtSp
of the scheme.
BE.Setup(pars): RunCPABE.Setup(pars) to obtain the master public key CP-MPK
and the master secret key CP-MSK. Let BE-MPK := CP-MPK, BE-MSK := CP-MSK and output (BE-MPK,BE-MSK).
BE.KeyGen(BE-MPK,BE-MSK, i): Run CPABE.KeyGen(BE-MPK,BE-MSK, i) to
BE.Enc(BE-MPK, M, S): LetW
j∈Sj be the policy representing the disjunction of attributes (users)j∈S. LetAbe the access structure supporting this policy. Run CPABE.Enc(BE-MPK, M,A) to obtain a ciphertext C.
BE.Dec(BE-MPK, C, ski): Run CPABE.Dec on the same input to obtain either a
message M or a failure symbol⊥.
The correctness of the BE scheme follows directly from the correctness of the CP- ABE scheme Γ used to construct it. This guarantees that if user i satisfies the disjunction policy (i.e.i∈S) then he can successfully decrypt.
The following result holds.
Theorem 4.11 LetΓbe a policy-hiding and IND-CCA secure CP-ABE scheme sup- porting disjunction policies. Then the BE scheme constructed as above is adaptively ANO-IND-CCA secure.
Proof. Let A be an adversary against the ANO-IND-CCA security of the BE scheme. We will construct an adversary B that will interact with A to break the policy-hiding and IND-CCA security of Γ. The game proceeds as follows.
Setup. The challengerCrunsCPABE.PG(1λ) to obtainparsandCPABE.Setup(pars)
to generate the master public key CP-MPK and the master secret key CP-MSK and gives (pars,CP-MPK) to the adversaryA.
Phase 1. A can adaptively issue key-extraction queries for any useri∈U. Such a query is passed on toB, who gives it toC as secret-key query for attributei. C will respond to each query with the private keyski, which is passed toB, who then forwards it toAas the key for useri. Amay also issue decryption queries of the type (C, i), where i∈ U. B passes such queries to C and forwards C’s response toA.
Challenge. A selects two equal-length messages M0 and M1 ∈ MsgSp and two
equal-size target sets S0, S1 ⊆U, such that i /∈S0△S1 for any of the queries
require M0 =M1. A passes M0, M1, S0, S1 to B. B creates access structures
A0 and A1 expressing the disjunction of all the indices j ∈ S0 and k ∈ S1, respectively. It passes M0, M1,A0,A1 to C. C chooses a random b ← {0,1},
computesC⋆←CP
ABE.Enc(CP-MPK,Mb,Ab) and passesC⋆ toB, who in turn passes it to A.
Phase 2. Acontinues to issue secret-key-extraction queries with the restriction that
i /∈ S0△S1 and if i∈ S0∩S1 then we require M0 = M1. These queries are
dealt with by B as in Phase 1. A can also issue decryption queries with the restriction that ifC=C⋆ then eitheri /∈S
0△S1 ori∈S0∩S1 andM0 =M1.
Guess. The adversary outputs its guess b′ forband B outputs the same guess.
B perfectly simulates the ANO-IND-CCA game for A. Hence A’s advantage is as it would be in the real game and by construction Bwins whenever Adoes. BE and KP-ABE.Not so intuitive is to see BE as arising as a special instance of KP-ABE. In the definition of KP-ABE the policy input to the key generation algorithm is expressed by an access structure, which in our model is represented by an access tree. In order to realize BE using ABE, we select as the tree for generating the key of user i the trivial tree consisting of a single leaf for attribute i. In KP- ABE, decryption succeeds if the set of attributesS specified in the encryption phase satisfies the policy given during key generation. In particular, for the degenerate case of BE, the policy (tree) is satisfied if and only if the attribute (user) iis in S. This is precisely what is needed in the BE setting, i.e., a user ican decrypt if and only ifi∈S, whereS is the target broadcast set. Hence, BE can also be cast in the framework of KP-ABE.
We formalize this by considering a KP-ABE scheme K = (KPABE.PG,
KPABE.Setup,KPABE.KeyGen,KPABE.Enc,KPABE.Dec). Let U be the universe of at-
tributes, where |U|=n. We will construct a BE scheme fromK, having U as the universe of users and the same message and ciphertext space, in the following way:
BE.PG(1λ, n): RunKP
ABE.PGon input 1λand returnpars, which implicitly contain nand a description of the message spaceMsgSpand the ciphertext spaceCtSp
BE.Setup(pars): RunKPABE.Setup(pars) to obtain the master public key KP-MPK
and the master secret key KP-MSK. Let BE-MPK := KP-MPK, BE-MSK := KP-MSK and output (BE-MPK,BE-MSK).
BE.KeyGen(BE-MPK,BE-MSK, i): Run KPABE.KeyGen(BE-MPK,BE-MSK, i) to
obtain ski, the secret key corresponding to the single-leaf access tree i.
BE.Enc(BE-MPK, M, S): Run KPABE.Enc(BE-MPK, M, S) to obtain a ciphertext
C.
BE.Dec(BE-MPK, C, ski): Run KPABE.Dec on the same input to obtain either a
message M or a failure symbol⊥.
The correctness of the BE scheme follows from the correctness of the KP-ABE scheme K used to construct it since in our model a set of attributes S satisfies a single-leaf access tree if and only if the attribute associated with that leaf is in S.
The following result holds.
Theorem 4.12 LetKbe an attribute-hiding and IND-CCA secure KP-ABE scheme. Then the BE scheme constructed as above is adaptively ANO-IND-CCA secure.
Proof. Let A be an adversary against the ANO-IND-CCA security of the BE scheme. We will construct an adversary B that will interact with A to break the attribute-hiding and IND-CCA security ofK. The game proceeds as follows.
Setup. The challengerCrunsKPABE.PG(1λ) to obtainparsandKPABE.Setup(pars)
to generate the master public key KP-MPK and the master secret key KP-MSK and gives (pars,KP-MPK) to the adversaryA.
Phase 1. A can adaptively issue key-extraction queries for any useri∈U. Such a query is passed on toB, who gives it toCas secret-key query for the degenerate single-leaf access treei. C will respond to each query with the private keyski, which is passed toB, who then forwards it toAas the key for user i. Amay also issue decryption queries of the type (C, i), where i ∈ U. B passes such queries toC and forwards to C’s response to A.
Challenge. A selects two equal-length messages M0 and M1 ∈ MsgSp and two
equal-size target sets S0, S1 ⊆U, such that i /∈S0△S1 for any of the queries
imade in Phase 1. If for any of such queries we have thati∈S0∩S1 the we
requireM0 =M1. ApassesM0, M1, S0, S1 toB. BpassesM0, M1, S0, S1 toC.
C chooses a randomb← {0,1}, computes C⋆←KP
ABE.Enc(KP-MPK,Mb, Sb) and passesC⋆ toB, who in turn passes it to A.
Phase 2. A continues to issue secret-key-extraction queries with the restriction that i /∈S0△S1 and ifi∈S0∩S1 then we requireM0 =M1. These queries
are dealt with by B as in Phase 1. A can also issue decryption queries with the restriction that if (C, i) = (C⋆, i) then either i /∈ S
0△S1 ori ∈ S0∩S1
and M0=M1.
Guess. The adversary outputs its guess b′ forband B outputs the same guess.
B perfectly simulates the ANO-IND-CCA game for A. Hence A’s advantage is as it would be in the real game and by construction Bwins whenever Adoes.
What we have just proved provides us with a potentially powerful tool: all the progress achieved in the area of ABE could be highly relevant to the improve- ment of the state of the art of BE. In practice, this approach is limited to the currently available ABE schemes. In particular, what we are looking for ideally is an attribute(policy)-hiding KP(CP)-ABE scheme, with short ciphertexts, involving efficient algorithms, and which is non-selectively IND-CCA secure in the standard model. Unfortunately, we do not have such a scheme. We hence briefly recall what are the features of the existing ABE schemes.
The ABE research community has focused on obtaining schemes allowing for poli- cies that could be as expressive as possible [53, 32, 12, 70]. These schemes however only achieve selective security and provide no anonymity guarantee. Furthermore, they are not very efficient. In [54], the authors present athreshold CP-ABE scheme with constant-size ciphertext. Even if this limited policy could fit our purposes, the scheme unfortunately suffers from the same security drawbacks as the other ABE schemes.
the issue of anonymity, but the scheme the authors present is characterized by large keys and ciphertexts, linear innas opposed to the size ofS. Similar considerations go for the work in [61], where Lewko et al. introduce the notion offunctional encryption and provide a fully secure ABE scheme, but the private key and ciphertext sizes prevent it from being a suitable candidate for the construction of BE. Follow-up work in the area (for instance, [69]) suffers from the same limitation. Indeed these recently proposed primitives, which have ABE as a special case, are very powerful and their instantiation allows for great expressiveness. However, for the use of ABE that we have in mind, namely constructing ANOBE schemes, finding anonymous and fully secure ABE schemes that support even simple policies but that are efficient is still an open problem.