CiphertextPolicy AttributeBased Encryption基于属性的加密密文的政策.ppt

* * * * * * * * * * * Dual System Encryption:Realizing IBE and HIBE from Simple Assumptions Brent Waters * Identity-Based Encryption [S84,BF01,C01] Public Params MSK ID’ ID Authority Decrypt iff ID’ = ID IBE Security [BF01] Challenger M0, M1, ID* ? IDi (challenge ID) Attacker Public Params ID1 ID1 … IDQ IDQ b Enc(Mb , PP, ID*) b’ Adv = Pr[b’=b] -1/2 IBE Security Proofs “Partitioning” [BF01, C01, CHK03, BB04, W05] Simulator Challenge Space ID Space Priv. Key Space 2 Goals: Answer Attacker Queries Use Attacker Response Attacker Partitioning and Aborts Simulator ID Space Priv. Key Space Challenge Space ID1 ID2… … IDQ ID* (challenge ID) ? Attacker Abort and try again Finding a Balance Simulator Challenge Space ID Space Priv. Key Space Aborts effect security loss Challenge Space - “right size” C.S. = 1/Q (for Q queries ) = 1/Q no abort Structure gives problems! Hierarchical IBE Q queries per HIBE level = (1/Q)depth loss Attribute-Based Encryption similar :edu :gov Partitioning won’t work! The Gentry Approach [G06,GH09] Ready for both Shove degree Q poly into Short params = Complex Assumption Our Results IBE (w/ short parameters) HIBE Broadcast Encryption Full Security Simple Assumption: Decision Linear Given: g, u, v, ga , ub, Dist: va+b from R Dual System Encryption 2 types of Keys CTs ID Normal ID Semi-Functional ID Normal Semi-Functional Used in real system ? ID ? ? Types are indist. (with a caveat) Principles Simulator No aborts Change things slowly Hybrid over keys form Goal: Everything Semi Functional I’m ready for anything! Proof Overview – 3 Steps Simulator Challenge CT ? Semi Func. Keys ? Semi. Func. (one at a time!!) Argue Security ID1 ID2 … IDQ ID* ID1 ID2 IDQ ID Problem: Simulator can test keys! Simulator Create S.F. CT for “Bob” and unknown key for “Bob” Decryption works iff key is normal “Bob” ? “Bob” Resolution: Tweak Semantics Add “tags” tc , tk to C.T. and Key Decrypt iff IDc = IDk AND tc ? tk Negl. correctness error (can patch)