We propose a new generic framework for achieving fully secure attribute based encryption (ABE) in prime-order bilinear groups. It is generic in the sense that it can be applied to ABE for arbitrary predicate. All previously available frameworks that are generic in this sense are given only in composite-order bilinear groups, of which operations are known to be much less efficient than in prime-order ones for the same security level. These consist of the frameworks by Wee (TCC’14) and Attrapadung (Eurocrypt’14). Both provide abstractions of dual-system encryption techniques introduced by Waters (Crypto’09). Our framework can be considered as a prime-order version of Attrapadung’s framework and works in a similar manner: it relies on a main component called pair encodings, and it generically compiles any secure pair encoding scheme for a predicate in consideration to a fully secure ABE scheme for that predicate. One feature of our new compiler is that although the resulting ABE schemes will be newly defined in prime-order groups, we require essentially the same security notions of pair encodings as before. Beside the security of pair encodings, our framework assumes only the Matrix Diffie-Hellman assumption (Escala et al., Crypto’13), which is a weak assumption that includes the Decisional Linear assumption as a special case. As for its applications, we can plug in available pair encoding schemes and automatically obtain the first fully secure ABE realizations in prime-order groups for predicates of which only fully secure schemes in composite-order groups were known. These include ABE for regular languages, ABE for monotone span programs (and hence Boolean formulae) with short ciphertexts or keys, and completely unbounded ABE for monotone span programs. As a side result, we establish the first generic implication from ABE for monotone span programs to ABE for branching programs. This implies fully-secure ABE for branching programs in some new variants, namely, unbounded, short-ciphertext, and short-key. Previous schemes are bounded and require linear-size ciphertexts and keys.

/pdf/dual-system-encryption-framework-in-prime-order-groups-egg0mof6an.pdf

Dual System Encryption Framework in Prime-Order Groups.

We propose a new generic framework for achieving fully secure attribute based encryption ABE in prime-order bilinear groups. Previous generic frameworks by Wee TCC'14 and Attrapadung Eurocrypt'14 were given in composite-order bilinear groups. Both provide abstractions of dual-system encryption techniques introduced by Waters Crypto'09. Our framework can be considered as a prime-order version of Attrapadung's framework and works in a similar manner: it relies on a main component called pair encodings, and it generically compiles any secure pair encoding scheme for a predicate in consideration to a fully secure ABE scheme for that predicate. One feature of our new compiler is that although the resulting ABE schemes will be newly defined in prime-order groups, we require essentially the same security notions of pair encodings as before. Beside the security of pair encodings, our framework assumes only the Matrix Diffie-Hellman assumption Escalai¾?et al., Crypto'13, which includes the Decisional Linear assumption as a special case.

Recently and independently, prime-order frameworks are proposed also by Cheni¾?et al.i¾?Eurocrypt'15, and Agrawal and Chase TCC'16-A. The main difference is that their frameworks can deal only with information-theoretic encodings, while ours can also deal with computational ones, which admit wider applications. We demonstrate our applications by obtaining the first fully secure prime-order realizations of ABE for regular languages, ABE for monotone span programs with short-ciphertext, short-key, or completely unbounded property, and ABE for branching programs with short-ciphertext, short-key, or unbounded property.

Dual System Encryption Framework in Prime-Order Groups via Computational Pair Encodings

Attribute-Based Encryption ABE is an advanced form of public-key encryption where access control mechanisms based on attributes and policies are possible. In conventional ABE, attributes are specified as strings. However, there are certain applications where it is useful to specify attributes as numerical values and consider a predicate that determines if a certain numerical range would include a certain value. Examples of these types of attributes include time, position coordinate, person's age, rank, identity, and so on. In this paper, we introduce ABE for boolean formulae over Range Membership ABE-RM. We show generic methods to convert conventional ABE to ABE-RM. Our generic conversions are efficient as they introduce only logarithmic overheads in key and ciphertext sizes, as opposed to trivial methods, which would pose linear overheads. By applying our conversion to previous ABE schemes, we obtain new efficient and expressive ABE-RM schemes. Previous works that considered ABE with range attributes are specific and can only deal with either a single relation of range membership Paterson and Quaglia at SCN 2010, and Kasamatsu et al. at SCN 2012, or limited classes of policies, namely, only AND-gates of range attributes Shi et al. at IEEE S&P 2007, and some subsequent work. Our schemes are generic and can deal with expressive boolean formulae.

Attribute-Based Encryption for Range Attributes

Ciphertext policy attribute based encryption (CP-ABE) systems are suitable for supporting access control with complex attribute-based policies. But there is a few CP-ABE systems that support non-monotonic access structures. In this paper we present an efficient CP-ABE construction which supports \(\mathbf {NOT}\) operation as well as m-of-n threshold gates. This construction is proved to be selectively secure under decisional bilinear Diffie-Hellman assumption. The comparison between our scheme and other similar systems shows that our construction is an efficient and expressive CP-ABE construction that supports the negation of attributes.

Efficient CP-ABE with Non-monotonic Access Structures

Abstract Attribute-based encryption (ABE) cryptographically implements fine-grained access control on data. As such, data can be stored by an entity that is not necessarily trusted to enforce access control, or an entity that is not even trusted to have access to the plaintext data at all. Instead, access control can be externally enforced by a trusted entity. Additionally, some multi-authority variants of ABE—which do not have a central authority—can effectively and securely implement access control in multiple-domain settings. Furthermore, ABE is the only cryptographic approach to fine-grained access control that does not require an online trusted third party during access requests, and thus provides better availability properties. The actual realization of these theoretical advantages in practice depends on whether current state-of-the-art ABE schemes support the necessary core properties. Much progress has been made in the last two decades in pairing-based ABE schemes, owing to their versatility and efficiency. In fact, it is possible to support most core properties under strong security guarantees, while incurring acceptable storage and computational costs. It is therefore a good time to ask ourselves whether pairing-based ABE has reached its full practical potential. To answer this question, we provide a comprehensive systematized overview of various existing pairing-based ABE schemes and their core properties. We also investigate the relationship between these core properties and real-world access control requirements. We show that a few challenges remain, that must be overcome for ABE to reach its full potential as a mechanism to implement efficient and secure access control in practice. 

/pdf/systematizing-core-properties-of-pairing-based-attribute-1xhwn5tc.pdf

Systematizing core properties of pairing-based attribute-based encryption to uncover remaining challenges in enforcing access control in practice

We propose the first fully secure unbounded Attribute-Based Encryption (ABE) scheme such that the key size and ciphertext size can be directly traded off. Our proposed scheme is parameterized by a positive integer d, which can be arbitrarily chosen at setup. In our scheme, the ciphertext size is O(t/d), the private key size is O(md), and the public key size is O(d), where t, m are the sizes of attribute sets and policies corresponding to ciphertext and private key, respectively.

Tsutomu Matsumoto

Papers

Attribute Based Encryption with Direct Efficiency Tradeoff