Unbounded ABE via Bilinear Entropy Expansion, Revisited Jie Chen - - PowerPoint PPT Presentation

Unbounded ABE via Bilinear Entropy Expansion, Revisited

Jie Chen

ECNU

Junqing Gong

ENS de Lyon

Lucas Kowalczyk

Columbia University

Hoeteck Wee

ENS & CNRS

attribute-based encryption (ABE)

[SW05, GPSW06]

1

!"# !$#

attribute-based encryption (ABE)

[SW05, GPSW06]

2

!"#

$%" $!"

attribute-based encryption (ABE)

[SW05, GPSW06]

!"& !"' (’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’

3

!"#

$%" $!"

attribute-based encryption (ABE)

[SW05, GPSW06]

!"& !"' (’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’ (’CS’, ’Professor’) enc($)

4

attribute-based encryption (ABE)

[SW05, GPSW06]

(’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’ (’CS’, ’Professor’)

5

attribute-based encryption (ABE)

[SW05, GPSW06]

(’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’ (’CS’, ’Professor’)

6

attribute-based encryption (ABE)

[SW05, GPSW06]

collusion (’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’ (’CS’, ’Professor’)

7

attribute-based encryption (ABE)

[SW05, GPSW06]

(’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’ (’CS’, ’Professor’)

8

!"# !"$ !"%

&'" &!"

enc(&)

attribute-based encryption (ABE)

[SW05, GPSW06]

(’CS’ and ‘PhD’) or ‘Professor’ ’CS’ and ‘PhD’ ’EE’ and ‘Professor’ (’CS’, ’Professor’)

9

!"# !"$ !"%

&'" &!"

enc(&) all attributes: [.] = {1, 2, ⋯ , .}

attribute-based encryption (ABE)

[SW05, GPSW06]

!

" # = true

!

% # = false

!

& # = false

10

# ⊆ [)] +," +,% +,&

• .,
• +,

enc(-) all attributes: [)] = {1, 2, ⋯ , )}

ABE

bounded !"# = % &

11

' ⊆ [&]

!"#

+

, ' = true

+

• ' = false

+

. ' = false

all attributes: [&] = {1, 2, ⋯ , &}

unbounded ABE

[ LewkoWaters11 ]

unbounded !"# = %(')

12

bounded )*+ = , - . ⊆ [-]

)*+

2

3 . = true

2

4 . = false

2

5 . = false

all attributes: [-] = {1, 2, ⋯ , -}

state of the art

• LewkoWaters11
• OkamotoTakashima12
• RouselakisWaters13
• Attrapadung14
• KowalczykLewko15
• Attrapadung16
• AgrawalChase17

13

efficient (bilinear) groups

prime-order - asymmetric

adaptive security

adversary can choose the target at any time

standard assumption

!-Lin, DLin and more - without random oracle

state of the art

efficient (bilinear) groups

prime-order - asymmetric

adaptive security

adversary can choose the target at any time

static assumption

!-Lin, DLin and more

• LewkoWaters11
• OkamotoTakashima12
• RouselakisWaters13
• Attrapadung14
• KowalczykLewko15
• Attrapadung16
• AgrawalChase17

14

state of the art

• OkamotoTakashima12

15

efficient (bilinear) groups

prime-order - asymmetric

adaptive security

adversary can choose the target at any time

static assumption

!-Lin, DLin and more

this work

16

• more efficient: 40% shorter ciphertext/key; or
• more expressive: arithmetic span program

new and simpler unbounded ABE schemes

this work

17

more efficient: 40% shorter ciphertext/keyor

• more expressive: arithmetic span program

new and simpler unbounded ABE schemes

this work

18

more efficient: 40% shorter ciphertext/key more expressive: arithmetic span program new and simpler unbounded ABE schemes

this work

bounded ABE unbounded ABE

19

compiler

scheme

more efficient: 40% shorter ciphertext/key more expressive: arithmetic span program new and simpler unbounded ABE schemes

this work

entropy expansion lemma bounded ABE unbounded ABE

20

compiler

scheme proof

more efficient: 40% shorter ciphertext/key more expressive: arithmetic span program new and simpler unbounded ABE schemes

this work

bounded ABE unbounded ABE

21

compiler

scheme

more efficient: 40% shorter ciphertext/key more expressive: arithmetic span program new and simpler unbounded ABE schemes

• [ LOSTW10 ]

[ IW14 ]

compiler & lemma

22

entropy expansion lemma bounded ABE unbounded ABE compiler

compiler & lemma

23

entropy expansion lemma bounded ABE unbounded ABE compiler

bilinear group of composite order !"!#

compiler & lemma

24

entropy expansion lemma bounded ABE unbounded ABE compiler

!" ! ℍ

bilinear group of composite order $%$&

compiler & lemma

25

entropy expansion lemma bounded ABE unbounded ABE compiler

!" #: ! ℍ × ⟶

bilinear group of composite order ()(*

compiler & lemma

26

entropy expansion lemma bounded ABE unbounded ABE compiler

!" #: ! ℍ × ⟶

() (*

bilinear group of composite order +,+-

.1-subgroup .2-subgroup

⋅

compiler & lemma

27

entropy expansion lemma bounded ABE unbounded ABE compiler

!" #: ! ℍ × ⟶

() (*

bilinear group of composite order +,+-

.1-subgroup .2-subgroup

ℎ) ℎ*

.1-subgroup .2-subgroup

⋅ ⋅

compiler & lemma

28

bounded ABE unbounded ABE compiler

compiler & lemma

29

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

#(-subgroup

compiler & lemma

30

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

#(-subgroup ct '(

/*0, '( /

1 ∈ 3

compiler & lemma

31

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

#(-subgroup ct '(

/*0, '( /

1 ∈ 3

compiler & lemma

32

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

#(-subgroup ct sk '(

/*0, '( /

ℎ(

2*0, ℎ( 2

3 ∈ 5 3 ∈ 5

compiler & lemma

33

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

"#$ = ( '(, '(

/0, '( /+ )

#(-subgroup #(-subgroup ct sk 1 ∈ 3 1 ∈ 3 '(

4*5, '( 4

ℎ(

7*5, ℎ( 7

compiler & lemma

34

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

"#$ = ( '(, '(

/0, '( /+ )

#(-subgroup #(-subgroup ct sk 12 + 4 5 1( ⟻ 78 [ LewkoWaters11 ] 4 ∈ : 4 ∈ : '(

;*<, '( ;

ℎ(

>*<, ℎ( >

compiler & lemma

35

bounded ABE unbounded ABE compiler

! "#$ = ( '(, '(

*+, … , '( *- )

"#$ = ( '(, '(

/0, '( /+ )

1 ∈ 3 '(

4 /056⋅/+ , '( 4

#(-subgroup #(-subgroup 1 ∈ 3 ℎ(

9 /056⋅/+ , ℎ( 9

ct sk :; + 1 = :( ⟻ ?6 1 ∈ 3 1 ∈ 3 '(

4*@, '( 4

ℎ(

9*@, ℎ( 9

[ LewkoWaters11 ]

compiler & lemma

36

entropy expansion lemma bounded ABE unbounded ABE

! "#$ = ( '(, '(

*+, … , '( *- )

"#$ = ( '(, '(

/0, '( /+ )

1 ∈ 3 '(

4 /056⋅/+ , '( 4

#(-subgroup #(-subgroup 1 ∈ 3 ℎ(

9 /056⋅/+ , ℎ( 9

ct sk 1 ∈ 3 1 ∈ 3 '(

4*:, '( 4

ℎ(

9*:, ℎ( 9

compiler & lemma

37

entropy expansion lemma bounded ABE unbounded ABE

≈

" #$% = ( (), ()

+,, … , () +. )

#$% = ( (), ()

01, () 0, )

2 ∈ 4 ()

5 0167⋅0, , () 5

$)-subgroup $)-subgroup 2 ∈ 4 ℎ)

: 0167⋅0, , ℎ) :

ct sk 2 ∈ 4 2 ∈ 4 ()

5+;, () 5

ℎ)

:+;, ℎ) :

≈

compiler & lemma

38

" #$% = ( (), ()

+,, … , () +. )

#$% = ( (), ()

01, () 0, )

2 ∈ 4

entropy expansion lemma bounded ABE unbounded ABE

/

()

5 0167⋅0, , () 5

$)-subgroup $)-subgroup 2 ∈ 4 ℎ)

: 0167⋅0, , ℎ) :

ct sk 2 ∈ 4 2 ∈ 4 ()

5+;, () 5

ℎ)

:+;, ℎ) :

compiler & lemma

39

! ∈ # $%-subgroup

entropy expansion lemma bounded ABE unbounded ABE

&%

'(), &% '

+$, = ( &/, &/

01, &/ 02 )

! ∈ # &/

' 0145⋅02 , &/ '

$/-subgroup ! ∈ # ℎ/

8 0145⋅02 , ℎ/ 8

ℎ%

8(), ℎ% 8

! ∈ # ct sk

compiler & lemma

40

! ∈ # $%-subgroup

entropy expansion lemma bounded ABE unbounded ABE

≈

⋅

(%

)*+, (% )

• $. = ( (1, (1

23, (1 24 )

! ∈ # (1

) 2367⋅24 , (1 )

$1-subgroup ! ∈ # ℎ1

9 2367⋅24 , ℎ1 9

• $. = ( (1, (1

23, (1 24 )

! ∈ # (1

) 2367⋅24 , (1 )

$1-subgroup ! ∈ # ℎ1

9 2367⋅24 , ℎ1 9

ℎ%

9*+, ℎ% 9

! ∈ # ct sk

compiler & lemma

41

entropy expansion lemma bounded ABE unbounded ABE

dual system method [Waters09] ! ∈ # $%-subgroup

≈

⋅

(%

)*+, (% )

• $. = ( (1, (1

23, (1 24 )

! ∈ # (1

) 2367⋅24 , (1 )

$1-subgroup ! ∈ # ℎ1

9 2367⋅24 , ℎ1 9

• $. = ( (1, (1

23, (1 24 )

! ∈ # (1

) 2367⋅24 , (1 )

$1-subgroup ! ∈ # ℎ1

9 2367⋅24 , ℎ1 9

! ∈ # ct sk ℎ%

9*+, ℎ% 9

compiler & lemma

42

bounded ABE unbounded ABE

! ∈ # $%-subgroup

≈

⋅

(%

)*+, (% )

• $. = ( (1, (1

23, (1 24 )

! ∈ # (1

) 2367⋅24 , (1 )

$1-subgroup ! ∈ # ℎ1

9 2367⋅24 , ℎ1 9

• $. = ( (1, (1

23, (1 24 )

! ∈ # (1

) 2367⋅24 , (1 )

$1-subgroup ! ∈ # ℎ1

9 2367⋅24 , ℎ1 9

! ∈ # ct sk

entropy expansion lemma

(warm-up version) ℎ%

9*+, ℎ% 9

proof strategy

43

adversary’s view

• ur goal

!"# enc(!) )#* )#+ ⋮

• ur ABE

44

proof strategy

• ur goal

enc(%) $

random

%() enc(%) *)+ *), ⋮

• ur ABE

%() *)+ *), ⋮

• ur ABE

≈

45

proof strategy

step 1: use entropy expansion lemma

!"# enc(!) )#* )#+ ⋮

• ur ABE

46

proof strategy

step 1: use entropy expansion lemma

⋅ ≈

#$% = ( (), ()

+,, () +- )

/ ∈ 1 ()

2 +,34⋅+- , () 2

/ ∈ 1 ℎ)

6 +,34⋅+- , ℎ) 6

#$% = ( (), ()

+,, () +- )

/ ∈ 1 ()

2 +,34⋅+- , () 2

/ ∈ 1 ℎ)

6 +,34⋅+- , ℎ) 6

/ ∈ 1 (7

289, (7 2

/ ∈ 1 ℎ7

689, ℎ7 6

47

proof strategy

step 1: use entropy expansion lemma

! "#$ ! "#% ⋮ ' enc(,) enc(,) ,.# enc(,) "#$ "#% ⋮

• ur ABE

,.# "#$ "#% ⋮

• ur ABE

./-subgroup .$-subgroup .$-subgroup

⋅ ≈

48

proof strategy

step 1: use entropy expansion lemma

! "#$ ! "#% ⋮ ' enc(,)

./-subgroup

bounded ABE

! "#$ ! "#% ⋮ ' enc(,)

49

proof strategy

step 1: use entropy expansion lemma

./-subgroup

! enc(&)

use prior analysis

50

proof strategy

step 2: analyze bounded ABE

$ ) *+, ) *+- ⋮

bounded ABE

51

proof strategy

step 3: back to unbounded ABE

! enc(&) $ ) *+, ) *+- ⋮

⋅

enc(&) &0+ *+, *+- ⋮

• ur ABE

$

bounded ABE

entropy expansion lemma

!", !"

$, !" $%, !" $&

52

!"

', !" '$ ⋅ !" ')($%+,⋅$&) , !" ')

. ∈ 0

≈ ⋅

. ∈ 0 !2

', !2 '$ ⋅ !2 ')3) , !2 ')

!", !"

$, !" $%, !" $&

!"

', !" '$ ⋅ !" ')($%+,⋅$&) , !" ')

. ∈ 0

warm-up version

ABE ciphertext: . ∈ 4 ⊆ [0] ABE mpk ℎ"

9)$, ℎ" 9), ℎ" 9) $%+,⋅$&

. ∈ 0 ABE keys × ;: random self-reducibility ℎ"

9)$, ℎ" 9), ℎ" 9) $%+,⋅$&

. ∈ 0 ℎ"

9, ℎ" 9 3)

. ∈ 0

entropy expansion lemma

!", !"

$, !" $%, !" $&

53

!"

', !" '$ ⋅ !" ')($%+,⋅$&) , !" ')

. ∈ 0 ABE mpk ABE ciphertext: . ∈ 1 ⊆ [0] ABE keys × 6: random self-reducibility ℎ"

8)$, ℎ" 8), ℎ" 8) $%+,⋅$&

. ∈ 0 ℎ"

8)$,

entropy expansion lemma

!", !"

$, !" $%, !" $&

54

!"

', !" '$ ⋅ !" ')($%+,⋅$&) , !" ')

. ∈ 0 ABE mpk ABE ciphertext: . ∈ 1 ⊆ [0] ABE keys × 6: random self-reducibility ℎ"

8)$, ℎ" 8), ℎ" 8) $%+,⋅$&

. ∈ 0 ℎ"

8)$,

!", !"

$, !" $%, !" $&

!"

', !" '$ ⋅ !" ')($%+,⋅$&) , !" ')

. ∈ 0

55

entropy expansion lemma

ABE mpk ABE ciphertext: . ∈ 1 ⊆ [0] ABE keys × 6: random self-reducibility ℎ"

8)$, ℎ" 8), ℎ" 8) $%+,⋅$&

. ∈ 0 ℎ"

8)$,

!", !"

$, !" $%, !" $&

ℎ"

()$, ℎ" (), ℎ" () $%*+⋅$&

• ∈ /

56

!"

0, !" 0$ ⋅ !" 0)($%*+⋅$&) , !" 0)

• ∈ /

ABE ciphertext

entropy expansion lemma

ABE mpk ABE keys × 4: random self-reducibility ℎ"

()$,

!", !"

$, !" $%, !" $&

57

ℎ"

()$, ℎ" (), ℎ" () $%*+⋅$&

• ∈ /

!"

0, !" 0$ ⋅ !" 0)($%*+⋅$&) , !" 0)

• ∈ /

entropy expansion lemma

ABE keys × 4: random self-reducibility ABE ciphertext ABE mpk ℎ"

()$,

!", !"

$, !" $%, !" $&

58

ℎ"

()$, ℎ" (), ℎ" () $%*+⋅$&

• ∈ /

!"

0, !" 0$ ⋅ !" 0)($%*+⋅$&) , !" 0)

• ∈ /

entropy expansion lemma

ABE keys × 4: random self-reducibility ABE ciphertext ABE mpk ℎ"

()$,

[ KowalczykLewko15 ]

≈ ⋅

#$, #$

&, #$ &', #$ &(

59

ℎ$

*+&, ℎ$ *+, ℎ$ *+ &',-⋅&(

. ∈ 0 #$

1, #$ 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0 #$, #$

&, #$ &', #$ &(

ℎ$

*+&, ℎ$ *+, ℎ$ *+ &',-⋅&(

. ∈ 0 #$

1, #$ 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0

entropy expansion lemma

ABE keys × 5: random self-reducibility ABE ciphertext ABE mpk

≈ ⋅

ℎ$

%&', ℎ$ %&, ℎ$ %& ')*+⋅',

• ∈ /

0$

1, 0$ 1' ⋅ 0$ 1&(')*+⋅',) , 0$ 1&

60

04, 04

', 04 '), 04 ',

ℎ4

%&', ℎ4 %&, ℎ4 %& ')*+⋅',

• ∈ /

04

1, 04 1' ⋅ 04 1&(')*+⋅',) , 04 1&

• ∈ /

04, 04

', 04 '), 04 ',

ℎ4

%&', ℎ4 %&, ℎ4 %& ')*+⋅',

• ∈ /

04

1, 04 1' ⋅ 04 1&(')*+⋅',) , 04 1&

• ∈ /
• ∈ /

entropy expansion lemma

ABE keys × 6: random self-reducibility ABE ciphertext ABE mpk

≈ ⋅

61

• 1. #$ + & ⋅ #' ⟼ )&

*+, *+

• , *+
• ., *+
• /

ℎ+

12-, ℎ+ 12, ℎ+ 12 -.34⋅-/

5 ∈ 7 *+

8, *+ 8- ⋅ *+ 82(-.34⋅-/) , *+ 82

5 ∈ 7 *+, *+

• , *+
• ., *+
• /

ℎ+

12-, ℎ+ 12, ℎ+ 12 -.34⋅-/

5 ∈ 7 *+

8, *+ 8- ⋅ *+ 82(-.34⋅-/) , *+ 82

5 ∈ 7 ℎ;

12-, ℎ; 12, ℎ; 12 -.34⋅-/

5 ∈ 7 *;

8, *; 8- ⋅ *; 82(-.34⋅-/) , *; 82

5 ∈ 7

entropy expansion lemma

≈ ⋅

62

#$, #$

&, #$ &', #$ &(

ℎ$

*+&, ℎ$ *+, ℎ$ *+ &',-⋅&(

. ∈ 0 #$

1, #$ 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0 #$, #$

&, #$ &', #$ &(

ℎ$

*+&, ℎ$ *+, ℎ$ *+ &',-⋅&(

. ∈ 0 #$

1, #$ 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0 ℎ4

*+&, ℎ4 *+, ℎ4 *+ &',-⋅&(

. ∈ 0 #4

1, #4 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0

entropy expansion lemma

• 1. 56 + 8 ⋅ 59 ⟼ ;8

≈ ⋅

63

#$, #$

&, #$ &', #$ &(

ℎ$

*+&, ℎ$ *+, ℎ$ *+ &',-⋅&(

. ∈ 0 #$

1, #$ 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0 #$, #$

&, #$ &', #$ &(

ℎ$

*+&, ℎ$ *+, ℎ$ *+ &',-⋅&(

. ∈ 0 #$

1, #$ 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0 ℎ4

*+&, ℎ4 *+, ℎ4 *+ &',-⋅&(

. ∈ 0 #4

1, #4 1& ⋅ #$ 1+(&',-⋅&() , #$ 1+

. ∈ 0 ℎ4

*+, ℎ4 *+56

#4

1+56, #4 1+

entropy expansion lemma

• 1. 78 + 6 ⋅ 7: ⟼ 56

≈ ⋅

• need auxiliary #$-subgroup [LW11, OT12]
• Lewko-Waters IBE [LW10]

64

%&, %&

(, %& (), %& (*

ℎ&

,-(, ℎ& ,-, ℎ& ,- ()./⋅(*

0 ∈ 2 %&

3, %& 3( ⋅ %& 3-(()./⋅(*) , %& 3-

0 ∈ 2 %&, %&

(, %& (), %& (*

ℎ&

,-(, ℎ& ,-, ℎ& ,- ()./⋅(*

0 ∈ 2 %&

3, %& 3( ⋅ %& 3-(()./⋅(*) , %& 3-

0 ∈ 2 ℎ6

,-(, ℎ6 ,-, ℎ6 ,- ()./⋅(*

0 ∈ 2 %6

3, %6 3( ⋅ %& 3-(()./⋅(*) , %& 3-

0 ∈ 2 ℎ6

,-, ℎ6 ,-78

%6

3-78, %6 3-

entropy expansion lemma

• 1. 9: + 8 ⋅ 9< ⟼ 78

≈ ⋅

• need auxiliary #$-subgroup [LW11, OT12]
• Lewko-Waters IBE [LW10]

65

%&, %&

(, %& (), %& (*

ℎ&

,-(, ℎ& ,-, ℎ& ,- ()./⋅(*

0 ∈ 2 %&

3, %& 3( ⋅ %& 3-(()./⋅(*) , %& 3-

0 ∈ 2 %&, %&

(, %& (), %& (*

ℎ&

,-(, ℎ& ,-, ℎ& ,- ()./⋅(*

0 ∈ 2 %&

3, %& 3( ⋅ %& 3-(()./⋅(*) , %& 3-

0 ∈ 2 ℎ6

,-(, ℎ6 ,-, ℎ6 ,- ()./⋅(*

0 ∈ 2 %6

3, %6 3( ⋅ %& 3-(()./⋅(*) , %& 3-

0 ∈ 2 ℎ6

,-, ℎ6 ,-78

%6

3-78, %6 3-

entropy expansion lemma

• 1. 9: + 8 ⋅ 9< ⟼ 78

≈ ⋅

2. #, %& ↦ ()*, %&)

• Lewko-Waters IBE [LW10]

66

,-, ,-

., ,- ./, ,- .0

ℎ-

23., ℎ- 23, ℎ- 23 ./4&⋅.0

5 ∈ 7 ,-

8, ,-

• 8. ⋅ ,-

83(./4&⋅.0) , ,- 83

5 ∈ 7 ,-, ,-

., ,- ./, ,- .0

ℎ-

23., ℎ- 23, ℎ- 23 ./4&⋅.0

5 ∈ 7 ,-

8, ,-

• 8. ⋅ ,-

83(./4&⋅.0) , ,- 83

5 ∈ 7 ℎ9

23#, ℎ9 23, ℎ9 23 ./4&⋅.0

5 ∈ 7 ,9

8, ,9 8# ⋅ ,- 83(./4&⋅.0) , ,- 83

5 ∈ 7 ℎ9

23, ℎ9 23:*

,9

83:*, ,9 83

entropy expansion lemma

• need auxiliary ;<-subgroup [LW11, OT12]
• 1. #= + * ⋅ #? ⟼ :*

≈ ⋅

• Lewko-Waters IBE [LW10]

67

2. #, %& ↦ ()*, %&) ,-, ,-

., ,- ./, ,- .0

ℎ-

23., ℎ- 23, ℎ- 23 ./4&⋅.0

5 ∈ 7 ,-

8, ,-

• 8. ⋅ ,-

83(./4&⋅.0) , ,- 83

5 ∈ 7 ,-, ,-

., ,- ./, ,- .0

ℎ-

23., ℎ- 23, ℎ- 23 ./4&⋅.0

5 ∈ 7 ,-

8, ,-

• 8. ⋅ ,-

83(./4&⋅.0) , ,- 83

5 ∈ 7 ℎ9

23#, ℎ9 23, ℎ9 23 ./4&⋅.0

5 ∈ 7 ,9

8, ,9 8# ⋅ ,- 83(./4&⋅.0) , ,- 83

5 ∈ 7 ℎ9

23, ℎ9 23:*

,9

83:*, ,9 83

entropy expansion lemma

• need auxiliary ;<-subgroup [LW11, OT12]
• 1. #= + * ⋅ #? ⟼ :*

ℎ"

#$%, ℎ" #$, ℎ" #$ '()*⋅',

• "

., -" .% ⋅ -/ .$('()*⋅',) , -/ .$

≈ ⋅

• "

.34

ℎ"

#$34

• Lewko-Waters IBE [LW10]

68

2. %, 5* ↦ (34, 5*)

• /, -/

', -/ '(, -/ ',

ℎ/

#$', ℎ/ #$, ℎ/ #$ '()*⋅',

7 ∈ 9

• /

., -/ .' ⋅ -/ .$('()*⋅',) , -/ .$

7 ∈ 9

• /, -/

', -/ '(, -/ ',

ℎ/

#$', ℎ/ #$, ℎ/ #$ '()*⋅',

7 ∈ 9

• /

., -/ .' ⋅ -/ .$('()*⋅',) , -/ .$

7 ∈ 9 7 ∈ 9 7 ∈ 9 ℎ"

#$, ℎ" #$:4

• "

.$:4, -" .$

entropy expansion lemma

• need auxiliary ;<-subgroup [LW11, OT12]
• 1. %= + 4 ⋅ %? ⟼ :4

ℎ"

#$%, ℎ" #$, ℎ" #$ '()*⋅',

≈ ⋅

LOSTW10: a classical ABE under ./0 = (3", 3"

45, … , 3" 47)

69

39, 39

', 39 '(, 39 ',

ℎ9

#$', ℎ9 #$, ℎ9 #$ '()*⋅',

: ∈ < 39

=, 39 =' ⋅ 39 =$('()*⋅',) , 39 =$

: ∈ < 39, 39

', 39 '(, 39 ',

ℎ9

#$', ℎ9 #$, ℎ9 #$ '()*⋅',

: ∈ < 39

=, 39 =' ⋅ 39 =$('()*⋅',) , 39 =$

: ∈ < 3"

=, 3" =% ⋅ 39 =$('()*⋅',) , 39 =$

3"

=4>

ℎ"

#$4>

: ∈ < : ∈ < ℎ"

#$, ℎ" #$?>

3"

=$?>, 3" =$

entropy expansion lemma

prime-order scheme

[ CGW15, GDCC16 ]

70

!", !"

$, !" $%, !" $&

ℎ"

()$, ℎ" (), ℎ" () $%*+⋅$&

• ∈ /

!"

0, !" 0$ ⋅ !" 0)($%*+⋅$&) , !" 0)

• ∈ /

prime-order scheme

!"

# [ CGW15, GDCC16 ]

$" $"

%

&#

71

$", $"

(, $" (), $" (*

ℎ"

,-(, ℎ" ,-, ℎ" ,- ()./⋅(*

1 ∈ 3 $"

%, $" %( ⋅ $" %-(()./⋅(*) , $" %-

1 ∈ 3

6-Lin

prime-order scheme

!

[ CGW15, GDCC16 ]

"#

$%

"#

%

72

"#, "#

%, "# %', "# %(

ℎ#

*+%, ℎ# *+, ℎ# *+ %',-⋅%(

/ ∈ 1 "#

$, "# $% ⋅ "# $+(%',-⋅%() , "# $+

/ ∈ 1 4#

5

65

prime-order scheme

! " #

[ CGW15, GDCC16 ]

ℎ% ℎ%

&

ℎ%

&'

73

(%, (%

', (% '*, (% '+

ℎ%

&,', ℎ% &,, ℎ% &, '*-.⋅'+

0 ∈ 2 (%

3, (% 3' ⋅ (% 3,('*-.⋅'+) , (% 3,

0 ∈ 2

prime-order scheme

! "

[ CGW15, GDCC16 ]

dimension of W

74

$%, $%

', $% '(, $% ')

ℎ%

+,', ℎ% +,, ℎ% +, '(-.⋅')

0 ∈ 2 $%

3, $% 3' ⋅ $% 3,('(-.⋅')) , $% 3,

0 ∈ 2 6%

7

prime-order scheme

!

[ CGW15, GDCC16 ]

"#

$

"%

$

LOSTW10 auxiliary

dimension of W height: 3( ↦ 2( + 1 GDCC16

• urs

entropy expansion lemma

75

• ., -.

0, -. 01, -. 02

ℎ.

450, ℎ. 45, ℎ. 45 0167⋅02

9 ∈ ;

• .

<, -. <0 ⋅ -. <5(0167⋅02) , -. <5

9 ∈ ; ".

$

prime-order scheme

! "

[ CGW15, GDCC16 ]

#$

%

dimension of W width: ' ↦ ' + 1

+

height: 3' ↦ 2' + 1 GDCC16

• urs

LOSTW10

analyze LOSTW10

76

./, ./

1, ./ 12, ./ 13

ℎ/

561, ℎ/ 56, ℎ/ 56 1278⋅13

: ∈ < ./

=, ./ =1 ⋅ ./ =6(1278⋅13) , ./ =6

: ∈ <

summary

77

summary

78

entropy expansion lemma bounded ABE unbounded ABE compiler

scheme proof

summary

79

? more applications of entropy expansion technique? ? entropy expansion lemma from lattices?

• pen problems

entropy expansion lemma bounded ABE unbounded ABE compiler

scheme proof

summary

80

? more applications of entropy expansion technique? ? entropy expansion lemma from lattices? Thank You • Very Much !

• pen problems

entropy expansion lemma bounded ABE unbounded ABE compiler

scheme proof