Download presentation

Published byElijah McDermott Modified over 5 years ago

1
Fully Secure Functional Encryption: Attribute-Based Encryption and (Hierarchical) Inner Product Encryption Allison Lewko Tatsuaki Okamoto Amit Sahai The University of Texas at Austin NTT UCLA Katsuyuki Takashima Brent Waters Mitsubishi Electric The University of Texas at Austin

2
**Functional Encryption**

Functionality f(x,y) – specifies what will be learned about ciphertext x y Learn f(x,y) and nothing else General applications: processing encrypted data, access control

3
Application Who should be able to read my data? access policy

4
**Attribute-Based Encryption [SW05]**

Ciphertexts: associated with access formulas (A Ç B) Æ C Secret Keys: associated with attributes {A, C} Decryption: {A, C} satisfies (AÇB)ÆC {A, C} Message (A Ç B) Æ C

5
**ABE Example OR AND AND Medical researcher Company X Doctor Hospital Y**

{Doctor, Hospital Z} {Nurse, Hospital Y}

6
**ABE Algorithms Encrypt(PP, M, Access formula)**

MSK Public Params Setup (¸, U) Encrypt(PP, M, Access formula) KeyGen(PP, MSK, Set of attributes) Decrypt(PP, SK, CT) M

7
**Security Definition (ABE) [IND-CPA GM84]**

Key Query Phase II Key Query Phase I Challenge Phase Setup Phase Challenger Attacker Public Params S1 MSK S1 S2 Si : set of attributes S2 M0, M1, access policy A Enc(Mb, A, PP) Same as Phase I – in both phases, no queried Si can satisfy A Attacker must guess b

8
** Proving Security Hard problem Hard problem ABE ABE attacker**

Make arrows ABE attacker Simulator breaks ABE

9
**Challenges in Proving Security**

Simulator must: respond to key requests leverage attacker’s success on challenge

10
Partitioning Previous approach for IBE – Partitioning [BF01, BB04, W05] Key Space We hope: Key Request Key Requests Key Request Key Request Abort Challenge Challenge Abort Challenge

11
**Partitioning with More Structure**

ID0 HIBE: ID0:ID1 ID0:ID2 ID0:ID1:ID3 ID0:ID2:ID4 ID0:ID2:ID5 Exponential security degradation in depth ABE: ( A Ç B Ç C) Æ (A Ç D) … Exponential security degradation in formula length

12
**Previous Solutions Selective Security Model:**

Attacker declares challenge before seeing Public Parameters A weaker model of security To go to standard model by guessing –> exponential loss Until recently, only results were in this model Exception: Fully secure HIBE with polynomially many levels [G06, GH09]

13
**Dual System Encryption [W09]**

New methodology for proving full security No partitioning, no aborts Simulator prepared to make any key and use any key as the challenge

14
**Dual System Encryption**

Normal Used in real system Semi-Functional Normal Semi-Functional Types are indistinguishable (with a caveat)

15
**Hybrid Security Proof Normal keys and ciphertext**

Normal keys, S.F. ciphertext S.F. ciphertext, keys turn S.F. one by one Security now much easier to prove

16
**Previously on Dual System Encryption…**

[W09] Fully secure IBE and HIBE [LW10] Fully secure HIBE with short CTs negligible correctness error ciphertext size linear in depth of hierarchy no correctness error CT = constant # group elements closely resembles selectively secure scheme [BBG05]

17
**Our Results - ABE Fully secure ABE arbitrary monotone access formulas**

security proven from static assumptions closely resembles selectively secure schemes [GPSW06, W08]

18
**ABE – Solution Framework**

G = a bilinear group of order N = p1p2p3 e: G £ G ! GT is a bilinear map Subgroups Gp1, Gp2, Gp3 – orthogonal under e, e.g. e(Gp1, Gp2) = 1 Gp1 = main scheme Gp1 Gp2 = semi-functional space Gp3 Gp2 Gp3 = randomization for keys

19
**ABE – Solution Framework**

Gp1 Gp2 Gp3 Normal S.F. Decryption: Key paired with CT under e Normal S.F.

20
**Technical Challenge Achieve nominal semi-functionality: [LW10] ?**

S.F. key and S.F. CT correlated - decryption works in simulator’s view regular S.F. key in attacker’s view ? simulator can’t test for S.F.

21
**Key Technique Semi-functional space imitates the main scheme**

Linear Secret Sharing Scheme: shares reconstructed in parallel in Gp1 and Gp2 shares secret shares secret Regular s.f. : red secret is random, masks blue result Nominal s.f. : red secret is 0, won’t hinder decryption

22
**Key Technique Attacker doesn’t have key capable of decrypting**

Attacker can’t distinguish nominal from regular s.f. Oh no! I was fooled! Value shared in s.f. space is info-theoretically hidden

23
**Illustrative Example ? ? A B {A} shared value = x AND share = z**

share = x-z Note if attacker has a different key for B it will have a different shared value associated {A}

24
**Technical Challenge g1a±1+ z1r1 g2±2 + z2r2 g1r1g2r2**

Hiding the shared value in the CT: blinding factors linked to attributes Ciphertext elements are of the form: share blinding share blinding g1a±1+ z1r1 g2±2 + z2r g1r1g2r2 random random where g1 2 Gp1 g2 2 Gp2 Attributes can only be used once in the formula

25
**Encoding Solution Example: To use an attribute A up to 4 times : A A:1**

(A Æ B) Ç (A Æ C) becomes (A:1 Æ B) Ç (A:2 Æ C) max times used fixed at setup It would be better to get rid of the one-use restriction Open problem

26
**Summary of ABE result Full security ABE Static assumptions**

Similar to selectively secure schemes

27
**Inner Product Encryption [KSW08]**

Ciphertexts and secret keys: associated with vectors x v Decryption: if x ¢ v = 0 Message x v Advantage: ciphertext policy can be hidden

28
**Coming Attractions Stay tuned for CRYPTO 2010:**

full security for Inner Product/ Attribute-Based Encryption from decisional Linear Assumption by Okamoto and Takashima

29
Questions?

Similar presentations

Presentation is loading. Please wait....

OK

Allison Lewko TexPoint fonts used in EMF.

Allison Lewko TexPoint fonts used in EMF.

© 2019 SlidePlayer.com Inc.

All rights reserved.

To make this website work, we log user data and share it with processors. To use this website, you must agree to our Privacy Policy, including cookie policy.

Ads by Google