Attribute-Based Signatures

Abstract

We introduce Attribute-Based Signatures (ABS), a versatile primitive that allows a party to sign a message with fine-grained control over identifying information. In ABS, a signer, who possesses a set of attributes from the authority, can sign a message with a predicate that is satisfied by his attributes. The signature reveals no more than the fact that a single user with some set of attributes satisfying the predicate has attested to the message. In particular, the signature hides the attributes used to satisfy the predicate and any identifying information about the signer (that could link multiple signatures as being from the same signer). Furthermore, users cannot collude to pool their attributes together.We give a general framework for constructing ABS schemes, and then show several practical instantiations based on groups with bilinear pairing operations, under standard assumptions. Further, we give a construction which is secure even against a malicious attribute authority, but the security for this scheme is proven in the generic group model. We describe several practical problems that motivated this work, and how ABS can be used to solve them. Also, we show how our techniques allow us to extend Groth-Sahai NIZK proofs to be simulation-extractable and identity-based with low overhead.

Fine-Grained Access Control Aware Multi-User Data Sharing with Secure Keyword Search

“…Our scheme builds on the work by Bethencourt et al, Ciphertext-policy attribute-based encryption (CP-ABE) [3], and Maji et al, Attribute-based signature (ABS) [14]. Only a conceptual introduction is given here, please refer to Appendix A for a more detailed algorithm description.…”

Short Attribute-Based Signatures for Threshold Predicates

“…Attribute-based signatures (shortened as ABS in the sequel) have been introduced more recently in [24] (see also [30,21,22]). They are related to the notion of (threshold) ring signatures [28,7] or mesh signatures [6], but offer much more flexibility and versatility to design secure complex systems, since the signatures are linked not to the users themselves, but to their attributes.…”

“…They are related to the notion of (threshold) ring signatures [28,7] or mesh signatures [6], but offer much more flexibility and versatility to design secure complex systems, since the signatures are linked not to the users themselves, but to their attributes. As a consequence, these signatures have a wide range of applications, like private access control, anonymous credentials, trust negotiations, distributed access control mechanisms for ad hoc networks, attribute-based messaging... (see [24] for detailed descriptions of applications). In terms of security, ABS must first satisfy unforgeability, which guarantees that a signature cannot be computed by a user who does not have the right attributes, even if he colludes with other users by pooling together their secret keys.…”

“…Among the schemes proposed up to now, those of Maji, Prabhakaran, Rosulek proposed in [24] work for very expressive signing predicates, but their most practical scheme is only proven secure in the generic group model. In [27], this scheme is claimed to be "almost optimally efficient", although its signatures' length grows linearly in the size of the span program (which is greater than the number of involved attributes in the signing predicate).…”

“…Our result shows that this claim is not true, at least for some families of predicates (e.g., threshold). Some other instantiations in [24] are secure in the standard model, but are pretty inefficient (i.e., the signature size is linear in the security parameter of the scheme), because they use Groth-Sahai proofs for relations between the bits of elements in the group. Okamoto and Takashima designed in [27] a fully secure ABS in the standard model which supports general non-monotone predicates.…”