Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption

Abstract

Abstract. We present two fully secure functional encryption schemes: a fully secure attribute-based encryption (ABE) scheme and a fully secure (attribute-hiding) predicate encryption (PE) scheme for inner-product predicates. In both cases, previous constructions were only proven to be selectively secure. Both results use novel strategies to adapt the dual system encryption methodology introduced by Waters. We construct our ABE scheme in composite order bilinear groups, and prove its security from three static assumptions. Our ABE scheme supports arbitrary monotone access formulas. Our predicate encryption scheme is constructed via a new approach on bilinear pairings using the notion of dual pairing vector spaces proposed by Okamoto and Takashima.

Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting

“…We note that some composite order systems employing dual system encryption, such as the attribute-based encryption scheme in [25], already have analogs in prime order groups proven secure from DLIN using dual pairing vector spaces. In [33], Okamoto and Takashima provide a functional encryption scheme in prime order bilinear groups that is proven fully secure under DLIN.…”

“…For example, the systems presented in [27,25,29,28,26] provide diverse and advanced functionalities like identity-based encryption (IBE), hierarchical identity-based encryption (HIBE), and attribute-based encryption with strong security guarantees (e.g. full security, leakage-resilience) proven from static assumptions.…”

“…These include GrothOstrovsky-Sahai proofs [22,21], the Boneh-Sahai-Waters traitor tracing scheme [10,15], and the functional encryption schemes of Lewko-Okamoto-Sahai-Takashima-Waters [25,33]. Waters also notes that the dual system encryption techniques in [39] used to obtain prime order systems were first instantiated in composite order groups.…”

“…A reduction to DLIN is only provided for the most basic variant of the subgroup decision assumption, and does not extend (for example) to the general subgroup decision assumption from [3]. Second, the step of translating the proof fails for many schemes, including all of the recent composite order schemes employing the dual system encryption proof methodology [27,25,29,28,26]. These schemes use only canceling and not projecting, and so this is unrelated to the limitations discussed in [30].…”

Doubly spatial encryption from DBDH

“…The DBDH assumption is extremely appealing in its simplicity: the assumption is simple to state, the ensuing schemes as well as the proof of security are typically extremely simple too; these schemes have also been standardized [8]. Furthermore, we continue to draw on the techniques developed in these early works: the development of lattice-based (hierarchical) identitybased encryption ((H)IBE) schemes in [11,1,2] parallel corresponding DBDH-based schemes in [10,4,20] and the simplest instantiations of the dual system encryption framework in [16,17] proceed by "embedding" prior DBDH-based schemes into composite-order groups. The fundamental role that the DBDH assumption plays in functional encryption motivates us to understand the limitations on the functionalities that we can realize from the DBDH assumption: namely,…”