Dual System Encryption Framework in Prime-Order Groups via - PowerPoint PPT Presentation

1 Dual System Encryption Framework in Prime-Order Groups via Computational Pair Encodings Nuttapong Attrapadung (Nuts) AIST, Japan Asiacrypt 2016 Hanoi, Vietnam, December 7, 2016

2 Our Main Result in One Slide A Generic Framework for Fully Secure ABE in Prime-order Groups Implies many first fully-secure & prime-order instantiations: ABE for regular languages, Short-ciphertext ABE, etc.

3 1 Introduction

4 Attribute Based Encryption (ABE) [SW05] ABE for predicate R: X × Y → {0,1} Key for Ciphertext for Decrypt x ∈ X y ∈ Y (encrypt M) M if R(x,y)=1 ? if R(x,y)=0

5 More Complete Picture of ABE Setup Master Public key Master Secret key x y,M Encrypt KeyGen Key for Ciphertext for Decrypt x ∈ X y ∈ Y (encrypt M) M if R(x,y)=1 ? if R(x,y)=0

6 Example of Predicates 1. Key-Policy ABE for Boolean Formulae [GPSW06] • suitable for content-based access control. Movie Drama OR Disney AND Japanese Soccer Animation Movie Disney policy x attribute set y associated to associated to • R(x,y)=1 iff y satisfies x.

7 Example of Predicates 2. Ciphertext-Policy ABE for Boolean Formulae [BSW07,W11] • suitable for person-based access control. Ph.D. OR CS AND Thai CEO Asian Ph.D. CS attribute set x policy y associated to associated to • R(x,y)=1 iff x satisfies y.

8 Example of Predicates 3. Dual-Policy ABE for Boolean Formulae [ A I09] OR Blood AND Fat value Heart date:201507 Blood date:201507 y 1 x 1 y 2 x 2 OR Doctor:K AND Department:X AND Patient:Bob Nurse Hospital:T Clinic:A Doctor:K Hospital:T • R(x,y)=1 iff y 1 satisfies x 1 AND x 2 satisfies y 2 .

9 More Examples of Predicates (1/2) R ( x , y ) = 1 What Predicate iff x ∈ { 0 , 1 } n y ∈ { 0 , 1 } n x = y Identity Based (IBE) [S84, BB04,..] x ∈ Z n y ∈ Z n � x , y � = 0 Inner Product (IPE) p p [KSW08] y x x � y � = � Doubly Spatial (DSE) Z n [H11] (affine spaces in ) p

10 More Examples of Predicates (2/2) R ( x , y ) = 1 What Predicate iff Span Program [GPSW06,…] Finite Automata [W12, A 14] f ( · ) y f ( y ) = 1 f Branching Program in that class [GVW13,IW14] Circuits [GGHSW13,GVW13]

11 Is there a generic way to design ABE for arbitrary predicate R ?

12 Yes, using recent generic frameworks [A. Eurocrypt 14], [Wee TCC14] “Pair encoding” for R Fully secure ABE for R ⇒ + Subgroup Decision • Advantage of pair encoding: security is much easier! • Perfect [ A 14,W14] : Info-theoretic argument. • Computational [ A 14] : Similar to selective security. • But yield ABEs in composite-order groups .

13 Motivation for Prime-order Groups • Better efficiency than composite-order groups. [G13] • Element size: 256 bits vs 3072 bits • Bilinear pairing: 254 times faster

14 Recent Prime-order Frameworks • [Chen,Gay,Wee EC15], [Agrawal, Chase TCC16] • extending [W14,A14]. • but only for perfect encoding • This work : both perfect & computational encoding

15 Computational enc covers many more Computational encoding • boolean formula [A14,AY15,AHY15] - KP, CP, DP - fully unbounded - short-key or short-ciphertext • boolean formula over doubly-spatial - KP, CP, DP [A14,AY15] • finite automata (regular language) Perfect encoding - KP, CP, DP [W12,A14,AY15] • IBE, IPE, Spatial • boolean formula with some bounds [LOSTW10,W14, A14,…]

16 Our Main Theorem Fully secure ABE for R Pair encoding for R ⇒ (Prime-order) + Matrix DH [EHK+13] Security of pair encoding: same as [A14] ☺ Syntax: more restricted, but all current encodings satisfy! [A14] Fully secure ABE for R Pair encoding for R ⇒ (Composite-order) + Subgroup Decision

17 Instantiations: Apply to Existing Encodings Computational encoding • boolean formula [A14,AY15,AHY15] The first fully-secure & - KP, CP, DP prime-order schemes - fully unbounded - short-key or short-ciphertext • boolean formula over doubly-spatial - KP, CP, DP [A14,AY15] • finite automata (regular language) Perfect encoding - KP, CP, DP [W12,A14,AY15] • IBE, IPE, Spatial • branching program • boolean formula with - KP, CP, DP some bounds - unbounded [new] [LOSTW10,W14, A14,…] - short-key or short-ciphertext [new]

18

19 2 Scheme

20 Bilinear Maps e : G 1 × G 2 → G T PrimeG ( λ ) → ( e , p , g 1 , g 2 ) groups of prime order p G 1 , G 2 : generators g 1 ∈ G 1 , g 2 ∈ G 2 CompositeG ( λ ) → ( e , N , g 1 , ˆ g 1 , g 2 , ˆ g 2 ) N = pq groups of composite order G 1 , G 2 : g 1 ∈ G 1 , p , ˆ g 1 ∈ G 1 , q , g 2 ∈ G 2 , p , ˆ g 2 ∈ G 2 , q

21 Pair Encoding Scheme (PES) [ A 14] Syntax : Param ( κ ) → n k r h m 1 , m 2 Enc 1 ( x , N ) → k k x ( α , r r , h h ) and c s h Enc 2 ( y , N ) → c c y ( s s , h h ) w 1 , w 2 and E ∈ Z m 1 × w 1 E Pair ( x , y , N ) → E N h ] w 1 h ] m 1 c s h k r h c c y ∈ Z N [ s s , h k k x ∈ Z N [ α , r r , h where and have variables: h r s α , h h = ( h 1 , . . . , h n ) , r r = ( r 1 , . . . , r m 2 ) , s s = ( s 0 , . . . , s w 2 ) α , r i , h k r i , s j , h k s j Ensure linearity and only monomials .

22 Pair Encoding Scheme (PES) [ A 14] Syntax : Param ( κ ) → n k r h m 1 , m 2 Enc 1 ( x , N ) → k k x ( α , r r , h h ) and c s h Enc 2 ( y , N ) → c c y ( s s , h h ) w 1 , w 2 and E ∈ Z m 1 × w 1 E Pair ( x , y , N ) → E N h ] w 1 h ] m 1 c s h k r h c c y ∈ Z N [ s s , h k k x ∈ Z N [ α , r r , h where and have variables: h r s α , h h = ( h 1 , . . . , h n ) , r r = ( r 1 , . . . , r m 2 ) , s s = ( s 0 , . . . , s w 2 ) α , r i , h k r i , s j , h k s j and only monomials . Correctness : k E c R ( x , y ) = 1 k k x E Ec c � y = α s 0 ⇒

23 Fully Secure ABE from PES [ A 14, simplified] CompositeG ( λ ) → ( e , N , g 1 , ˆ g 1 , g 2 , ˆ g 2 ) , Setup ( λ , κ ) : ← Z n PES . Param ( κ ) → n , h h h $ $ ← Z N , α N , � 1 , e ( g 1 , g 2 ) α � h g 1 , g h h PK = � � h g 2 , g h h 2 , g α MSK = 2

24 Fully Secure ABE from PES [ A 14, simplified] CompositeG ( λ ) → ( e , N , g 1 , ˆ g 1 , g 2 , ˆ g 2 ) , Setup ( λ , κ ) : ← Z n PES . Param ( κ ) → n , h h h $ $ ← Z N , α N , � 1 , e ( g 1 , g 2 ) α � h g 1 , g h h PK = � � h g 2 , g h h 2 , g α MSK = 2 ← Z w 2 Encrypt ( PK , y , M ) : c s PES . Enc 2 ( y , N ) → ( c c y , w 1 , w 2 ) , s s $ N , c s h c c y ( s s , h h ) � � , e ( g 1 , g 2 ) α s 0 · M g CT = 1

25 Fully Secure ABE from PES [ A 14, simplified] CompositeG ( λ ) → ( e , N , g 1 , ˆ g 1 , g 2 , ˆ g 2 ) , Setup ( λ , κ ) : ← Z n PES . Param ( κ ) → n , h h h $ $ ← Z N , α N , � 1 , e ( g 1 , g 2 ) α � h g 1 , g h h PK = � � h g 2 , g h h 2 , g α MSK = 2 ← Z w 2 Encrypt ( PK , y , M ) : c s PES . Enc 2 ( y , N ) → ( c c y , w 1 , w 2 ) , s s $ N , c s h c c y ( s s , h h ) � � , e ( g 1 , g 2 ) α s 0 · M g CT = 1 ← Z m 2 r KeyGen ( MSK , x ) : k r r PES . Enc 1 ( x , N ) → ( k k x , m 1 , m 2 ) , $ N , k r h SK = g k k x ( α , r r , h h ) 2

26 Fully Secure ABE from PES [ A 14, simplified] c s h c c y ( s s , h h ) � � , e ( g 1 , g 2 ) α s 0 · M g CT = 1 k r h SK = g k k x ( α , r r , h h ) 2 E PES . Pair ( x , y , N ) → E E , Decrypt ( CT y , SK x ) : E c E Ec c � k , g k k � � � k E c = e ( g 1 , g 2 ) k k x E Ec c � y = e ( g 1 , g 2 ) α s 0 e e e g y x 1 2 M M e ( g M 1 , g M M 1 M 2 M M 2 ) := e ( g 1 , g 2 ) M M � 2 M M 1 e where e

27 Fully Secure ABE from PES [ A 14, simplified] � 1 , e ( g 1 , g 2 ) α � h g 1 , g h h PK = � � h g 2 , g h h 2 , g α MSK = 2 c s h c c y ( s s , h h ) � � , e ( g 1 , g 2 ) α s 0 · M g CT = 1 k r h SK = g k k x ( α , r r , h h ) 2

28 Example: IBE [BB04,LW10] ( h 1 , h 2 ) � 1 , e ( g 1 , g 2 ) α � h g 1 , g h h PK = � � h g 2 , g h h s 0 ( h 1 + yh 2 ) , s 0 2 , g α � � MSK = 2 c s h c c y ( s s , h h ) � � , e ( g 1 , g 2 ) α s 0 · M g CT = 1 k r h SK = g k k x ( α , r r , h h ) α + r 1 ( h 1 + xh 2 ) , r 1 � � 2 If x = y E E E s 0 ( h 1 y + h 2 ) = α s 0 α + r 1 ( h 1 + xh 2 ) , r 1 0 1 � � s 0 − 1 0

29 Towards Prime-order Setting Substitute scalar by vector/matrix as in [Chen, Wee C13] . α � Z d + 1 H k � Z ( d + 1 ) × ( d + 1 ) H h k H �� α p �� p s j � Z d r i � Z d s r s j s r i r �� �� p p Z ∈ Z ( d + 1 ) × ( d + 1 ) B Z with a distribution S d , B B , Z Generators : pick p 2 � G ( d + 1 ) × d 1 � G ( d + 1 ) × d Z L g Z ZL L B L g B BL L g 2 g 1 �� �� 2 1 d d 1 d 1 where . L B L = L L := ... d + 1 1 0 (left projection)

30 Towards Prime-order Setting s j � Z d H k � Z ( d + 1 ) × ( d + 1 ) s s j s H h k H �� p �� p 1 � G ( d + 1 ) × d B L g B BL L g 1 �� 1 Exponentiations : H B L � G ( d + 1 ) × d g h k g H H k B BL L �� 1 1 1 B L s s j B BL Ls s j � G ( d + 1 ) × 1 g g �� 1 1 1 H B L s h k s j H H k B BL Ls s j � G ( d + 1 ) × 1 g g �� 1 1 1 (tweaked from [CW13] , which is not directly applicable.)