Fast, compact, and expressive attribute-based encryption

Abstract

Attribute-based encryption (ABE) is an advanced cryptographic tool and useful to build various types of access control systems. Toward the goal of making ABE more practical, we propose key-policy (KP) and ciphertext-policy (CP) ABE schemes, which first support unbounded sizes of attribute sets and policies with negation and multi-use of attributes, allow fast decryption, and are adaptively secure under a standard assumption, simultaneously. Our schemes are more expressive than previous schemes and efficient enough. To achieve the adaptive security along with the other properties, we refine the technique introduced by Kowalczyk and Wee (Eurocrypt'19) so that we can apply the technique more expressive ABE schemes. Furthermore, we also present a new proof technique that allows us to remove redundant elements used in their ABE schemes. We implement our schemes in 128-bit security level and present their benchmarks for an ordinary personal computer and smartphones. They show that all algorithms run in one second with the personal computer when they handle any policy or attribute set with one hundred attributes. KeywordsAttribute-based encryption • Standard assumption • Non-monotone • Unbounded • Multi-use • Random oracle model Mathematics Subject Classification 94A60 Communicated by M. Paterson.

Systematizing core properties of pairing-based attribute-based encryption to uncover remaining challenges in enforcing access control in practice

“…In the realm of pairing-based ABE, a special subtype of non-monotonicity-which we shall refer to as "labeled non-monotonicity"-was proposed by Okamoto and Takashima [122], and was later further investigated and developed in [22,141]. These works explicitly use the attribute labels-corresponding to our notion of attribute types-in access policies.…”

“…Labeled non-monotonicity can be used to securely implement access control that supports negations in dynamic practical settings [22,141]. For instance, consider a situation in which a new label is added to a system and used in a negation during encryption.…”

“…For example, the TKN20 [141] scheme supports labeled non-monotonicity by using FDHbased and polynomial-based methods to support large universes. Unlike FDH-based largeuniverse constructions, the scheme uses an FDH to map the universe labels to the group.…”

“…In summary, so far, all existing large-universe constructions incur a significant efficiency trade-off. On the one hand, FDH-based schemes typically have less efficient key generation and encryption algorithms, but more efficient decryption algorithms [4,141,145]. On the other hand, polynomial-based schemes may allow for very efficient implementations of key generation and encryption, but have much less efficient decryption algorithms [10,101,130].…”

“…Although this group provided sufficient security when these works were published, they are currently estimated to provide roughly only 100 bits of security [24]. In contrast, Tomida et al [141] provided a performance analysis that uses a group with sufficient security, but no source code was published, so it is unclear whether they have used libraries for arithmetic. Observation 6 Apart from the low security levels, these implementations may have some other shortcomings, notably with respect to the efficiency.…”