Comment on “An Efficient ABE Scheme With Verifiable Outsourced Encryption and Decryption”

Abstract

, Li et al.[1] proposed a secure outsourcing algorithm for modular exponentiation in one single untrusted server model and a new method of generating transformation keys. They claimed that their solution can securely outsource encryption and decryption to untrusted ESP (encryption service providers) and DSP (decryption service providers), leaving only a constant number of simple operations for the DO (data owner) and eligible users to perform locally. In addition, both DO and qualified users can check the correctness of the results returned from ESP and DSP, respectively. Although the authors provide security proofs for their scheme, unfortunately, after carefully observing their scheme, we find that the scheme has security vulnerabilities. These vulnerabilities allow the adversary to generate the sub-key for any attribute and replace ciphertext sub-item, which result in the adversary to be able to break their scheme. In response to this problem, we propose an improved solution and proved its security. INDEX TERMS Attribute-based encryption, security vulnerability, key generation, ciphertext replacement.

Secure Multi-Keyword Search and Access Control over Electronic Health Records in Wireless Body Area Networks

“…eir scheme not only reduces the storage cost of mobile devices but also requires only a small amount of computing overhead to complete the decryption. However, Guo et al [13] found that there was a security problem in Li et al's scheme [12] and put forward an improved scheme. Fan et al [14] proposed a secure and effective outsourcing computing algorithm to solve the problem of a large amount of computing in existing schemes for data encrypting on mobile devices.…”