[PPT] - Dual System Encryption Framework in Prime-Order Groups via PowerPoint Presentation

SLIDE 1

Dual System Encryption Framework in Prime-Order Groups via Computational Pair Encodings

Nuttapong Attrapadung (Nuts) AIST, Japan

Asiacrypt 2016 Hanoi, Vietnam, December 7, 2016

1

SLIDE 2

Our Main Result in One Slide

A Generic Framework for Fully Secure ABE in Prime-order Groups Implies many first fully-secure & prime-order instantiations: ABE for regular languages, Short-ciphertext ABE, etc.

2

SLIDE 3

Introduction

1

3

SLIDE 4

ABE for predicate R: X × Y → {0,1}

Attribute Based Encryption (ABE) [SW05]

Decrypt

Ciphertext for y∈Y (encrypt M) Key for x∈X M ? if R(x,y)=1 if R(x,y)=0

4

SLIDE 5

More Complete Picture of ABE

Setup

Master Secret key Master Public key

KeyGen Encrypt

x y,M

Decrypt

Ciphertext for y∈Y (encrypt M) Key for x∈X M ? if R(x,y)=1 if R(x,y)=0

5

SLIDE 6

Example of Predicates

Soccer Disney Movie OR AND

1. Key-Policy ABE for Boolean Formulae [GPSW06]

policy x associated to attribute set y

suitable for content-based access control.

associated to

Drama Japanese Disney Animation Movie

R(x,y)=1 iff y satisfies x.

6

SLIDE 7

Example of Predicates

CEO CS Ph.D. OR AND

2. Ciphertext-Policy ABE for Boolean Formulae [BSW07,W11]

policy y associated to attribute set x

suitable for person-based access control.

associated to

CS Thai Ph.D.

R(x,y)=1 iff x satisfies y.

Asian

7

SLIDE 8

Example of Predicates

Heart date:201507 Blood OR AND

3. Dual-Policy ABE for Boolean Formulae [AI09]
R(x,y)=1 iff y1 satisfies x1 AND x2 satisfies y2.

Blood date:201507 Fat value Patient:Bob Hospital:T Doctor:K OR AND Doctor:K Hospital:T Department:X AND Nurse Clinic:A

x1 x2 y1 y2

8

SLIDE 9

More Examples of Predicates (1/2)

Identity Based (IBE)

[S84, BB04,..]

Inner Product (IPE)

[KSW08]

Doubly Spatial (DSE)

[H11]

What Predicate

iff (affine spaces in )

x ∈ {0, 1}n y ∈ {0, 1}n x = y R(x, y) = 1 x ∈ Zn

p

y ∈ Zn

p

x, y = 0 x y x y = Zn

p

9

SLIDE 10

More Examples of Predicates (2/2)

Finite Automata

[W12,A14]

Branching Program

[GVW13,IW14]

Circuits

[GGHSW13,GVW13]

What Predicate

iff

y Span Program

[GPSW06,…]

in that class R(x, y) = 1 f(·) f(y) = 1 f

10

SLIDE 11

Is there a generic way to design ABE for arbitrary predicate R ?

11

SLIDE 12

Yes, using recent generic frameworks

⇒

“Pair encoding” for R [A. Eurocrypt 14], [Wee TCC14] + Subgroup Decision

Advantage of pair encoding: security is much easier!
Perfect [A14,W14]: Info-theoretic argument.
Computational [A14]: Similar to selective security.
But yield ABEs in composite-order groups.

Fully secure ABE for R

12

SLIDE 13

Motivation for Prime-order Groups

Better efficiency than composite-order groups. [G13]
Element size: 256 bits vs 3072 bits
Bilinear pairing: 254 times faster

13

SLIDE 14

Recent Prime-order Frameworks

[Chen,Gay,Wee EC15], [Agrawal, Chase TCC16]
extending [W14,A14].
but only for perfect encoding
This work: both perfect & computational encoding

14

SLIDE 15

IBE, IPE, Spatial
boolean formula with

some bounds

boolean formula [A14,AY15,AHY15]
KP, CP, DP
fully unbounded
short-key or short-ciphertext
boolean formula over doubly-spatial
KP, CP, DP [A14,AY15]
finite automata (regular language)
KP, CP, DP [W12,A14,AY15]

Perfect encoding Computational encoding [LOSTW10,W14, A14,…]

Computational enc covers many more

15

SLIDE 16

Our Main Theorem

Pair encoding for R

⇒

[A14] + Subgroup Decision Fully secure ABE for R (Composite-order) Pair encoding for R

⇒

+ Matrix DH [EHK+13] Fully secure ABE for R (Prime-order) Syntax: more restricted, but all current encodings satisfy! Security of pair encoding: same as [A14]☺

16

SLIDE 17

boolean formula [A14,AY15,AHY15]
KP, CP, DP
fully unbounded
short-key or short-ciphertext
boolean formula over doubly-spatial
KP, CP, DP [A14,AY15]
finite automata (regular language)
KP, CP, DP [W12,A14,AY15]

Computational encoding

Instantiations: Apply to Existing Encodings

The first fully-secure & prime-order schemes

Perfect encoding [LOSTW10,W14, A14,…]

IBE, IPE, Spatial
boolean formula with

some bounds

branching program
KP, CP, DP
unbounded [new]
short-key or short-ciphertext [new]

17

SLIDE 18

18

SLIDE 19

Scheme

2

19

SLIDE 20

Bilinear Maps

PrimeG(λ) → (e, p, g1, g2) CompositeG(λ) → (e, N, g1, ˆ g1, g2, ˆ g2) e : G1 × G2 → GT groups of prime order p generators g1 ∈ G1, g2 ∈ G2 G1, G2 : groups of composite order G1, G2 : N = pq g1 ∈ G1,p, ˆ g1 ∈ G1,q, g2 ∈ G2,p, ˆ g2 ∈ G2,q

20

SLIDE 21

Ensure linearity

Pair Encoding Scheme (PES) [A14]

Param(κ) → n Syntax: w1, w2 and and m1, m2 Pair(x, y, N) → E E E ∈ Zm1×w1

N

where and have variables: c c cy ∈ ZN[s s s, h h h]w1 k k kx ∈ ZN[α, r r r, h h h]m1 α, h h h = (h1, . . . , hn), r r r = (r1, . . . , rm2), s s s = (s0, . . . , sw2) Enc1(x, N) → k k kx(α, r r r, h h h) Enc2(y, N) → c c cy(s s s, h h h) . α, ri, hkri, sj, hksj and only monomials

21

SLIDE 22

Pair Encoding Scheme (PES) [A14]

Param(κ) → n Syntax: w1, w2 and and m1, m2 Pair(x, y, N) → E E E ∈ Zm1×w1

N

where and have variables: c c cy ∈ ZN[s s s, h h h]w1 k k kx ∈ ZN[α, r r r, h h h]m1 α, h h h = (h1, . . . , hn), r r r = (r1, . . . , rm2), s s s = (s0, . . . , sw2) Enc1(x, N) → k k kx(α, r r r, h h h) Enc2(y, N) → c c cy(s s s, h h h) Correctness: R(x, y) = 1 ⇒ k k kxE E Ec c c

y = αs0

. α, ri, hkri, sj, hksj and only monomials

22

SLIDE 23

Fully Secure ABE from PES [A14, simplified]

MSK =

g2, gh

h h 2, gα 2

Setup(λ, κ) :

PES.Param(κ) → n, α

$

← ZN, h h h

$

← Zn

N,

PK =

g1, gh

h h 1, e(g1, g2)α

CompositeG(λ) → (e, N, g1, ˆ g1, g2, ˆ g2),

23

SLIDE 24

Fully Secure ABE from PES [A14, simplified]

CT =

g

c c cy(s s s,h h h) 1

, e(g1, g2)αs0 · M

MSK =
g2, gh

h h 2, gα 2

Setup(λ, κ) :

PES.Param(κ) → n, Encrypt(PK, y, M) : α

$

← ZN, h h h

$

← Zn

N,

PK =

g1, gh

h h 1, e(g1, g2)α

s s s

$

← Zw2

N ,

PES.Enc2(y, N) → (c c cy, w1, w2), CompositeG(λ) → (e, N, g1, ˆ g1, g2, ˆ g2),

24

SLIDE 25

Fully Secure ABE from PES [A14, simplified]

CT =

g

c c cy(s s s,h h h) 1

, e(g1, g2)αs0 · M

SK = gk

k kx(α,r r r,h h h) 2

MSK =

g2, gh

h h 2, gα 2

Setup(λ, κ) :

PES.Param(κ) → n, Encrypt(PK, y, M) : KeyGen(MSK, x) : α

$

← ZN, h h h

$

← Zn

N,

PK =

g1, gh

h h 1, e(g1, g2)α

s s s

$

← Zw2

N ,

r r r

$

← Zm2

N ,

PES.Enc1(x, N) → (k k kx, m1, m2), PES.Enc2(y, N) → (c c cy, w1, w2), CompositeG(λ) → (e, N, g1, ˆ g1, g2, ˆ g2),

25

SLIDE 26

where CT =

g

c c cy(s s s,h h h) 1

, e(g1, g2)αs0 · M

SK = gk

k kx(α,r r r,h h h) 2

Fully Secure ABE from PES [A14, simplified]

PES.Pair(x, y, N) → E E E, e e e

g

E E Ec c c

y

1

, gk

k k

x

2

= e(g1, g2)k

k kxE E Ec c c

y = e(g1, g2)αs0

e e e(gM

M M1 1 , gM M M2 2 ) := e(g1, g2)M M M

2 M

M M1

Decrypt(CTy, SKx) :

26

SLIDE 27

CT =

g

c c cy(s s s,h h h) 1

, e(g1, g2)αs0 · M

SK = gk

k kx(α,r r r,h h h) 2

Fully Secure ABE from PES [A14, simplified]

MSK =

g2, gh

h h 2, gα 2

PK =
g1, gh

h h 1, e(g1, g2)α

27

SLIDE 28

CT =

g

c c cy(s s s,h h h) 1

, e(g1, g2)αs0 · M

SK = gk

k kx(α,r r r,h h h) 2

Example: IBE [BB04,LW10]

MSK =

g2, gh

h h 2, gα 2

PK =
g1, gh

h h 1, e(g1, g2)α

(h1, h2)

s0(h1 + yh2), s0
α + r1(h1 + xh2), r1
α + r1(h1 + xh2), r1
s0(h1y + h2)

s0 −1 1 = αs0 If x = y E E E

28

SLIDE 29

Towards Prime-order Setting

α

α Zd+1

p

ri

r

r ri Zd

p

hk

H

H Hk Z(d+1)×(d+1)

p

sj

s

s sj Zd

p

Substitute scalar by vector/matrix as in [Chen, Wee C13]. Generators: pick g1

gB

B BL L L 1 G(d+1)×d 1

g2

gZ

Z ZL L L 2 G(d+1)×d 2

L L L :=

1 1

...

d

d + 1

B B B, Z Z Z ∈ Z(d+1)×(d+1)

p

with a distribution Sd, where (left projection) L = B

d

1

.

d

29

SLIDE 30

ghk

1

gH

H HkB B BL L L 1

G(d+1)×d

1

g

hksj 1

g

H H HkB B BL L Ls s sj 1

G(d+1)×1

1

Exponentiations:

Towards Prime-order Setting

hk

H

H Hk Z(d+1)×(d+1)

p

sj

s

s sj Zd

p

g1

gB

B BL L L 1 G(d+1)×d 1

g

sj 1

g

B B BL L Ls s sj 1

G(d+1)×1

1

(tweaked from [CW13], which is not directly applicable.)

30

SLIDE 31

Composite-order groups Prime-order groups g

B B BL L Ls s sj 1

g

B B BJ J Jˆ sj 1

g

B B BL L Ls s sj 1

≈ g

sj 1 ˆ

g

ˆ sj 1

g

sj 1

≈ G1,p1 G1,p × G1,q subgroup whole group

d

1

d

1

subspace whole space

Subgroup-Decision Matrix-DH [EHK+13]

( right projection) J J J =

d-DLIN is an instance.

31

SLIDE 32

MSK =

gZ

Z ZL L L 2 , gH H H

1 Z

Z ZL L L 2

, . . . , gH

H H

n Z

Z ZL L L 2

, gα

2

g1, gh

h h 1

emulate

Our Prime-order ABE from PES

PK =

gB

B BL L L 1 , gH H H1B B BL L L 1

, . . . , gH

H HnB B BL L L 1

, e(g1, g2)αB

B BL L L

Setup(λ, κ) : PrimeG(λ) → (e, p, g1, g2), H H Hi

$

← Z(d+1)×(d+1)

p

, α

$

← Zd+1

p

, pick B B B, Z Z Z

$

← Sd,

32

SLIDE 33

Our Prime-order ABE from PES

PK =

gB

B BL L L 1 , gH H H1B B BL L L 1

, . . . , gH

H HnB B BL L L 1

, e(g1, g2)αB

B BL L L

MSK =

gZ

Z ZL L L 2 , gH H H

1 Z

Z ZL L L 2

, . . . , gH

H H

n Z

Z ZL L L 2

, gα

2

Encrypt(PK, y, M) :

KeyGen(MSK, x) : CTy =

g

c c cy

B

B BL L LS S S, H

1

, e(g1, g2)αB

B BL L Ls s s0 · M

SKx = g

k k kx

α, Z

Z ZL L LR R R, H

2

S S S

$

← Zd×(w2+1)

p

, R R R

$

← Zd×m2

p

,

33

SLIDE 34

Our Prime-order ABE from PES

PK =

gB

B BL L L 1 , gH H H1B B BL L L 1

, . . . , gH

H HnB B BL L L 1

, e(g1, g2)αB

B BL L L

MSK =

gZ

Z ZL L L 2 , gH H H

1 Z

Z ZL L L 2

, . . . , gH

H H

n Z

Z ZL L L 2

, gα

2

Encrypt(PK, y, M) :

KeyGen(MSK, x) : CTy =

g

c c cy

B

B BL L LS S S, H

1

, e(g1, g2)αB

B BL L Ls s s0 · M

SKx = g

k k kx

α, Z

Z ZL L LR R R, H

2

S S S

$

← Zd×(w2+1)

p

, R R R

$

← Zd×m2

p

, g

hksj 1

g

H H HkB B BL L Ls s sj 1

g

c c cy(s s s,h h h) 1

g

c c cy

B

B BL L LS S S, H

1

g

sj 1

g

B B BL L Ls s sj 1

H = (H H H1, . . . , H H Hn)

34

SLIDE 35

Our Prime-order ABE from PES

PK =

gB

B BL L L 1 , gH H H1B B BL L L 1

, . . . , gH

H HnB B BL L L 1

, e(g1, g2)αB

B BL L L

MSK =

gZ

Z ZL L L 2 , gH H H

1 Z

Z ZL L L 2

, . . . , gH

H H

n Z

Z ZL L L 2

, gα

2

Encrypt(PK, y, M) :

KeyGen(MSK, x) : CTy =

g

c c cy

B

B BL L LS S S, H

1

, e(g1, g2)αB

B BL L Ls s s0 · M

SKx = g

k k kx

α, Z

Z ZL L LR R R, H

2

S S S

$

← Zd×(w2+1)

p

, R R R

$

← Zd×m2

p

, gri

2

gZ

Z ZL L Lr r ri 2

gk

k kx(α,r r r,h h h) 2

g

k k kx

α,Z

Z ZL L LR R R, H

2

ghkri

2

g

H H H

k Z

Z ZL L Lr r ri 2

35

SLIDE 36

Our Prime-order ABE from PES

CTy =

g

c c cy

B

B BL L LS S S, H

1

, e(g1, g2)αB

B BL L Ls s s0 · M

SKx = g

k k kx

α, Z

Z ZL L LR R R, H

2

Decrypt(CTy, SKx) : PES.Pair(x, y, p) → E E E,

i∈[1,m1]

j∈[1,w1]

e e e(g

c c cy[j] 1

, gk

k kx[i] 2

)E

E Ei,j = e(g1, g2)αB B BL L Ls s s0

36

SLIDE 37

e(g

sj 1, ghkri 2 ) = e(g hksj 1

, gri

2)

e(g1, g2)(b

b bH H Hk)·a a a = e(g1, g2)b b b·(H H Hka a a)

Correctness: Use Associativity [CW13]

e e e(ga

a a 1, g H H H

k b

b b 2

) = e e e(gH

H Hka a a 1

, gb

b b 2)

Correctness of PES implicitly uses In bilinear map on scalars (as used in [A14]), we have sj · (hkri) = (hksj) · ri In bilinear map on vectors here, we have since e e e(gM

M M1 1 , gM M M2 2 ) := e(g1, g2)M M M

2 M

M M1

and recall

37

SLIDE 38

e(g

hsj 1

, ghkri

2 ) = e(g hksj 1

, ghri

2

) e(gH

H Ha a a 1

, g

H H H

k b

b b 2

) = e(gH

H Hka a a 1

, gH

H H

b

b b 2

) e(g1, g2)(b

b bH H Hk)·(H H Ha a a) = e(g1, g2)(b b bH H H)·(H H Hka a a)

What About Commutativity?

Correctness of PES also implicitly (possibly) uses In bilinear map on scalars (as used in [A14]), we have (hsj) · (hkri) = (hksj) · (hri) But, in bilinear map on vectors here, we have since

38

SLIDE 39

What About Commutativity? —No.

Correctness of PES also implicitly (possibly) uses (hsj) · (hkri) = (hksj) · (hri) Hence, we simply restrict PES to exclude these. Done by restricting E outputted from Pair. Call this as Rule I.

39

SLIDE 40

Security Proof

3

40

SLIDE 41

Definition for Full Security

x guess b Encrypt Mb PK … … Pictorially in timeline CTy y, M0, M1 SKx SKx x R(x, y) = 0 condition:

41

SLIDE 42

“Dual System” Proof Method [W09]

… … Real game Final game … … Normal “Semi-functional” advantage=0 Modify one at a time.

42

SLIDE 43

Semi-Functional (SF) Ciphertext/Key in [A14]

g

c c cy(s s s,h h h) 1

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

g

c c cy(s s s,h h h) 1

gk

k kx(α,r r r,h h h) 2

= = = gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,0 0,0 0) 2

=

43

SLIDE 44

Semi-Functional (SF) Ciphertext/Key in [A14]

g

c c cy(s s s,h h h) 1

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

g

c c cy(s s s,h h h) 1

gk

k kx(α,r r r,h h h) 2

= = = gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,0 0,0 0) 2

=

N S N N N S N S N S

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

= =

44

SLIDE 45

More “concretely” …

SLIDE 46

SLIDE 47

SLIDE 48

Proof Intuition 1 [A14]

g

c c cy(s s s,h h h) 1

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

g

c c cy(s s s,h h h) 1

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,0 0,0 0) 2

= = = =

N S N N N S N S N S

= =

48

SLIDE 49

Proof Intuition 1 [A14]

g

c c cy(s s s,h h h) 1

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

g

c c cy(s s s,h h h) 1

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,0 0,0 0) 2

= = = =

N S N N N S N S N S

= = “Copy” from Normal to SF can use Subgroup Decision. g

sj 1 ˆ

g

ˆ sj 1

g

sj 1

≈ Subgroup Decision

49

SLIDE 50

Proof Intuition 2 [A14]

g

c c cy(s s s,h h h) 1

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

g

c c cy(s s s,h h h) 1

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

gk

k kx(α,r r r,h h h) 2

gk

k kx(α,r r r,h h h) 2

ˆ gk

k kx(ˆ α,0 0,0 0) 2

= = = =

N S N N N S N S N S

= = The only remaining hybrid uses the security of PES.

50

SLIDE 51

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

S S S 51

SLIDE 52

Definition for Security of PES [A14]

ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

S S S

Given which? Computational security [A14] : Perfect security [A14, W14] : info-theoretic sense. For x, y s.t. R(x, y) = 0, x, y (each is queried once by in any order.)

52

SLIDE 53

Our Scheme: SF Ciphertext/Key

g

c c cy

B

B BL L LS S S, H

1

N S N N N S N S N S

g

c c cy

B

B BJ J Jˆ S S S, H

1

g

c c cy

B

B BL L LS S S, H

1

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

ˆ

α, Z Z ZJ J Jˆ R R R, H

2

g

k k kx

0, Z

Z ZJ J Jˆ R R R, H

2

g

k k kx

ˆ

α, 0 0 , 0

2

53

SLIDE 54

Our Proof Intuition 1

g

c c cy

B

B BL L LS S S, H

1

N S N N N S N S N S

g

c c cy

B

B BJ J Jˆ S S S, H

1

g

c c cy

B

B BL L LS S S, H

1

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

ˆ

α, Z Z ZJ J Jˆ R R R, H

2

g

k k kx

0, Z

Z ZJ J Jˆ R R R, H

2

g

k k kx

ˆ

α, 0 0 , 0

2

“Copy” now uses Matrix Diffie-Hellman [EHK+13]. New technique uses random self-reducibility of Mat-DH. g

B B BL L Ls s sj 1

g

B B BJ J Jˆ sj 1

g

B B BL L Ls s sj 1

≈ Matrix DH

54

SLIDE 55

Our Proof Intuition 2

g

c c cy

B

B BL L LS S S, H

1

N S N N N S N S N S

g

c c cy

B

B BJ J Jˆ S S S, H

1

g

c c cy

B

B BL L LS S S, H

1

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

α, Z

Z ZL L LR R R, H

2

g

k k kx

ˆ

α, Z Z ZJ J Jˆ R R R, H

2

g

k k kx

0, Z

Z ZJ J Jˆ R R R, H

2

g

k k kx

ˆ

α, 0 0 , 0

2

Goal: The remaining hybrid will use the security of PES. Problem: But security of PES was not in “matrix-form”.

55

SLIDE 56

Need to find a condition for reduction

so that the security of PES implies exactly this hybrid.

S S S

g

c c cy

B

B BJ J Jˆ S S S, H

1

g

k k kx

ˆ

α, Z Z ZJ J Jˆ R R R, H

2

g

k k kx

0, Z

Z ZJ J Jˆ R R R, H

2

Given which?

56

SLIDE 57

Need to find a condition for reduction

S S S

g

c c cy

B

B BJ J Jˆ S S S, H

1

g

k k kx

ˆ

α, Z Z ZJ J Jˆ R R R, H

2

g

k k kx

0, Z

Z ZJ J Jˆ R R R, H

2

Given which? ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

S S S

Given which? Security of PES Our hybrid

57

SLIDE 58

Need to find a condition for reduction

S S S

g

c c cy

B

B BJ J Jˆ S S S, H

1

g

k k kx

ˆ

α, Z Z ZJ J Jˆ R R R, H

2

g

k k kx

0, Z

Z ZJ J Jˆ R R R, H

2

Given which? ˆ g

c c cy(ˆ s s s,ˆ h h h) 1

ˆ gk

k kx(ˆ α,ˆ r r r,ˆ h h h) 2

ˆ gk

k kx(0,ˆ r r r,ˆ h h h) 2

S S S

Given which? Security of PES Can be defined solely on syntax.

hkri allowed only if ri is in kx.
hksj allowed only if sj is in cy.
s0 is in cy.

Call these as Rule 2,3,4.

Our conditions:

Our hybrid

58

SLIDE 59

Wrapping Up to Our Theorem

PES for R

⇒

+ Matrix DH [EHK+13] Fully secure ABE for R (Prime-order)

PES syntax is restricted to Rule 1,2,3,4.
PES security is unchanged from [A14].

59

SLIDE 60

Concluding Remarks

We presented a generic conversion from pair

encoding to fully secure ABE in prime-order groups.

It implies the first fully secure prime-order ABE

instantiations for many predicates.

Omitted here:
tighter reduction as in [A14].
can use simpler basis [CGW15], instead of [CW13].

60