Attribute-based versions of Schnorr and ElGamal

Herranz, Javier

doi:10.1007/s00200-015-0270-7

Cited by 8 publications

(6 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the meanwhile, the best ABE or IBE schemes that can be designed in those settings are relaxations of the original notions, for instance bounded-collision and/or symmetric IBE and ABE [11,4,5].…”

Section: Final Remarks and Conclusionmentioning

confidence: 99%

“…in [7, 8] are not secure, as we have proved in the previous sections) and maybe some similar impossibility black‐box results could be obtained in this sense. In the meanwhile, the best ABE or IBE schemes that can be designed in those settings are relaxations of the original notions, for instance bounded‐collision and/or symmetric IBE and ABE [9–11].…”

Section: Final Remarks and Conclusionmentioning

confidence: 99%

“…The same happens for efficient schemes in the RSA setting. We note that relaxed versions of these notions, such as bounded-IBE and bounded-ABE, can be obtained in this setting [9][10][11].…”

Section: Our Contributionsmentioning

confidence: 99%

See 2 more Smart Citations

Attribute‐based encryption implies identity‐based encryption

Herranz¹

2017

IET Inf. secur

Self Cite

View full text Add to dashboard Cite

Abstract. In this short paper we formally prove that designing attribute-based encryption schemes cannot be easier than designing identity-based encryption schemes. In more detail, we show how an attribute-based encryption scheme which admits, at least, AND policies can be combined with a collision-resistant hash function to obtain an identity-based encryption scheme. Even if this result may seem natural, not surprising at all, it has not been explicitly written anywhere, as far as we know. Furthermore, it may be an unknown result for some people: Odelu et al. [8,6] have proposed both an attribute-based encryption scheme in the Discrete Logarithm setting, without bilinear pairings, and an attributebased encryption scheme in the RSA setting, both admitting AND policies. If these schemes were secure, then by using the implication that we prove in this paper, we would obtain secure identity-based encryption schemes in both the RSA and the Discrete Logarithm settings, without bilinear pairings, which would be a breakthrough in the area. Unfortunately, we present here complete attacks of the two schemes proposed by Odelu et al. in [8,6].

show abstract

Section: Final Remarks and Conclusionmentioning

confidence: 99%

Section: Final Remarks and Conclusionmentioning

confidence: 99%

See 1 more Smart Citation

Attribute‐based encryption implies identity‐based encryption

Herranz¹

2017

IET Inf. secur

Self Cite

View full text Add to dashboard Cite

show abstract

“…Herranz constructs attribute-based signatures [30] using what is essentially a set membership argument for multiple values. Like this work, the argument relies only on the discrete logarithm assumption, but the communication complexity is much higher; linear in the size of the set.…”

Section: Referencementioning

confidence: 99%

Efficient Batch Zero-Knowledge Arguments for Low Degree Polynomials

Bootle

Groth

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Bootle et al. (EUROCRYPT 2016) construct an extremely efficient zero-knowledge argument for arithmetic circuit satisfiability in the discrete logarithm setting. However, the argument does not treat relations involving commitments, and furthermore, for simple polynomial relations, the complex machinery employed is unnecessary. In this work, we give a framework for expressing simple relations between commitments and field elements, and present a zero-knowledge argument which, by contrast with Bootle et al., is constant-round and uses fewer group operations, in the case where the polynomials in the relation have low degree. Our method also directly yields a batch protocol, which allows many copies of the same relation to be proved and verified in a single argument more efficiently with only a square-root communication overhead in the number of copies. We instantiate our protocol with concrete polynomial relations to construct zero-knowledge arguments for membership proofs, polynomial evaluation proofs, and range proofs. Our work can be seen as a unified explanation of the underlying ideas of these protocols. In the instantiations of membership proofs and polynomial evaluation proofs, we also achieve better efficiency than the state of the art.

show abstract

“…We stress that relaxed versions of IBE and ABE, such as bounded-IBE and bounded-ABE, can be obtained in these settings[6],[8],[18].…”

mentioning

confidence: 99%