Revisiting Attribute-Based Encryption With Verifiable Outsourced Decryption

Abstract

Attribute-based encryption (ABE) is a promising technique for fine-grained access control of encrypted data in a cloud storage, however, decryption involved in the ABEs is usually too expensive for resource-constrained front-end users, which greatly hinders its practical popularity. In order to reduce the decryption overhead for a user to recover the plaintext, Green et al. suggested to outsource the majority of the decryption work without revealing actually data or private keys. To ensure the third-party service honestly computes the outsourced work, Lai et al. provided a requirement of verifiability to the decryption of ABE, but their scheme doubled the size of the underlying ABE ciphertext and the computation costs. Roughly speaking, their main idea is to use a parallel encryption technique, while one of the encryption components is used for the verification purpose. Hence, the bandwidth and the computation cost are doubled. In this paper, we investigate the same problem. In particular, we propose a more efficient and generic construction of ABE with verifiable outsourced decryption based on an attributebased key encapsulation mechanism, a symmetric-key encryption scheme and a commitment scheme. Then, we prove the security and the verification soundness of our constructed ABE scheme in the standard model. Finally, we instantiate our scheme with concrete building blocks. Compared with Lai et al.'s scheme, our scheme reduces the bandwidth and the computation costs almost by half. IndexTerms-Attribute-based encryption, outsourced decryption, verifiability, access control.

Offline/online attribute‐based encryption with verifiable outsourced decryption

“…Thus, has no advantage in real security game. The proof is similar to . In order to occupy less space, we omit the detailed proof here.…”

“…Definition A KDF takes as input a secret key DK and a length l , then it outputs a string of l bits. KDF is secure if for any probabilistic polynomial‐time adversary , the following is negligible: Notice that DK denotes an initial secret key, l is the output length and R is chosen uniformly at random from {0,1} l .…”

“…Gentry et al [40] has shown that it would take at least 30 s on a high-performance machine, even for weak security parameters on 'bootstrapping' operation of the homomorphic encryption [8,33]. Lai et al [10] and Lin et al [13] provided practical schemes with verifiable outsourced decryption. Li et al [41] provided the scheme with outsourced encryption.…”

“…Definition 3 A KDF [13] takes as input a secret key DK and a length l, then it outputs a string of l bits. KDF is secure if for any probabilistic polynomial-time adversary A, the following is negligible: jP rOEA.KDF .DK; l// D 1 P rOEA.R/ D 1j:…”

An efficient encryption scheme with verifiable outsourced decryption in mobile cloud computing

“…In [14], Lai et al guaranteed that a user can efficiently check if the transformation is done correctly without relying on any random oracles. Compared with this scheme, Lin et al [15] proposed a more efficient construction ABE with verifiable outsourced decryption, which reduced the bandwidth and the computation costs almost by half. Some other similar works can be seen in [16][17][18].…”