Attribute-Based Cryptography

Attribute-Based Cryptography

Lecture 21And Pairing-Based Cryptography

1

Identity-Based Encryption

2

In PKE, KeyGen produces a random (PK,SK) pair


2


Can I have a “fancy public-key” (e.g., my name)?


2



But no one should be able to pick a PK and find an SK for it


2




But suppose a trusted authority for key generation


2





Then: Can it generate a valid (PK,SK) pair for any PK?


2






Identity-Based Encryption: a key-server (with a master secret-key) that can generate such pairs


2







Encryption will use the master public-key, and the receiver’s “identity” (i.e., fancy public-key)


2







Encryption will use the master public-key, and the receiver’s “identity” (i.e., fancy public-key)In PKE, sender has to retrieve PK for every party it wants to talk to (from a trusted public directory)


2







Encryption will use the master public-key, and the receiver’s “identity” (i.e., fancy public-key)In PKE, sender has to retrieve PK for every party it wants to talk to (from a trusted public directory)In IBE, receiver has to obtain its SK from the authority


2


3

Identity-Based EncryptionSecurity requirement for IBE (will skip formal statement):

3


Environment/adversary decides the ID of the honest parties (in the beginning or later on)

3


Environment/adversary decides the ID of the honest parties (in the beginning or later on)Adversary can adaptively request SK for any number of IDs (which are not used for honest parties)

3


Environment/adversary decides the ID of the honest parties (in the beginning or later on)Adversary can adaptively request SK for any number of IDs (which are not used for honest parties)“Semantic security” for encryption with the ID of honest parties (CPA: with no access to decryption)

3


Environment/adversary decides the ID of the honest parties (in the beginning or later on)Adversary can adaptively request SK for any number of IDs (which are not used for honest parties)“Semantic security” for encryption with the ID of honest parties (CPA: with no access to decryption)Or, CCA security: also gets (guarded) access to decryption for honest parties’ IDs

3



IBE (even CPA-secure) can easily give CCA-secure PKE!

3



IBE (even CPA-secure) can easily give CCA-secure PKE!IBE: Can’t malleate ciphertext for one ID into one for another

3



IBE (even CPA-secure) can easily give CCA-secure PKE!IBE: Can’t malleate ciphertext for one ID into one for anotherPKEncMPK(m) = (verkey, C=IBEncMPK(id=verkey; m), signsignkey(C) )

3



IBE (even CPA-secure) can easily give CCA-secure PKE!IBE: Can’t malleate ciphertext for one ID into one for anotherPKEncMPK(m) = (verkey, C=IBEncMPK(id=verkey; m), signsignkey(C) )

Digital Signature3


4

Identity-Based EncryptionNotion of IBE suggested by Shamir in 1984 (but no construction)

4


An “identity-based non-interactive key-distribution” scheme by Sakai-Ohgishi-Kasahara (2000) using bilinear-pairings and a random oracle

4



But no formal proof of security

4




Quadratic Residuosity based scheme by Cocks (2001)

4





But long ciphertexts (Shorter, but slower scheme by Boneh-Gentry-Hamburg (2007) )

4






Boneh-Franklin IBE (2001): similar to SKO ID-NIKD (but with a proof of security in the random oracle model)

4







Pairing-based, without RO: Boneh-Boyen (2004), Waters (2005), ...

4







Pairing-based, without RO: Boneh-Boyen (2004), Waters (2005), ...

Without pairing: Using QR, Lattices, ...

4

Bilinear Pairing

5

Bilinear PairingA relatively new (and less understood) tool

5


Two (or three) groups with an efficient pairing operation, e: G x G → GT that is “bilinear”

5



Typically, prime order (cyclic) groups

5




e(ga,hb) = e(g,h)ab

5




e(ga,hb) = e(g,h)ab

Multiplication (once) in the exponent!

5




e(ga,hb) = e(g,h)ab


e(gaga’,gb) = e(ga,gb) e(ga’,gb) ; e(ga,gbc) = e(gac,gb) ; ...

5




e(ga,hb) = e(g,h)ab


e(gaga’,gb) = e(ga,gb) e(ga’,gb) ; e(ga,gbc) = e(gac,gb) ; ...

Not degenerate: e(g,g,) ! 1

5

Decisional Bilinear- Diffie-Hellman Assumption

6


DDH is not hard in G, if there is a bilinear pairing

6



Given (ga,gb,gz) check if e(ga,gb) = e(gz,g)

6



Given (ga,gb,gz) check if e(ga,gb) = e(gz,g)

Decisional Bilinear DH assumption: (ga,gb,gc,gabc) is indistinguishable from (ga,gb,gc,gz). (a,b,c,z random)

6

IBE from Pairing

7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

MSK: hy

7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

MSK: hy

Enc(m;s) = ( gs, "(ID)s, M.Ys)

7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

MSK: hy


"(ID) = u Π uii:IDi=1

7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

MSK: hy


SK for ID: ( hy."(ID)t, gt ) = (d1, d2)


7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

MSK: hy



Dec ( a, b, c; d1, d2 ) = c/ [ e(b,d2) / e(a,d1) ]


7

IBE from Pairing

MPK: g,h, Y=e(g,h)y, " = (u,u1,...,un)

MSK: hy



Dec ( a, b, c; d1, d2 ) = c/ [ e(b,d2) / e(a,d1) ]

CPA security based on Decisional-BDH


7

Attribute-Based Encryption

8


Which users can decrypt a ciphertext will be decided by the attributes and policies associated with the message and the user

8



A central authority will create secret keys for the users (like in IBE) based on attributes/policies for each user

8



A central authority will create secret keys for the users (like in IBE) based on attributes/policies for each user

Ciphertexts can be created (by anyone) by incorporating attributes/policies

8

Ciphertext-Policy ABE

9


Users in the system have attributes; receives a key (or “key bundle”) from an authority for its set of attributes

9



Ciphertext contains a policy (a boolean predicate over the attribute space)

9




If a user’s attribute set satisfies the policy, can use its key bundle to decrypt the ciphertext

9





Multiple users cannot pool their attributes together

9





Multiple users cannot pool their attributes together

Application: End-to-End privacy in Attribute-Based Messaging

9

Key-Policy ABE

10

Key-Policy ABEAttributes will be assigned to a ciphertext (when creating the ciphertext)

10


Policies will be assigned to users/keys by an authority (who creates the keys)

10



A key can decrypt only those ciphertexts whose attributes satisfy the policy

10




E.g. Applications

10




E.g. Applications

Fuzzy IBE: use a policy that allows receiver’s ID to be slightly different from the one in the policy

10




E.g. Applications

Fuzzy IBE: use a policy that allows receiver’s ID to be slightly different from the one in the policy

Audit log inspection: grant auditor authority to read only messages with certain attributes

10

A KP-ABE Scheme

11

A KP-ABE SchemeA construction that supports “linear policies”

11


Policy corresponds to a (monotonic) access structure (sets of attributes that when pooled satisfy the policy)

11



Linear: Matrix L with each row labeled by an attribute, such that

11




a set of attributes S satisfies the policy iff there is a vector v such that v.L=[1 1 ... 1]

11





and, labels corresponding to non-zero entries of v are all contained in S

11






Linear algebra over some finite field (e.g. GF(p) )

11






Linear algebra over some finite field (e.g. GF(p) )

For efficiency need a small matrix11

Example of a “Linear Policy”

12


Consider this policy, over 7 attributes

12


Consider this policy, over 7 attributes OR

AND ANDAND

OR

12



L:OR

AND ANDAND

OR

12



L:OR

AND ANDAND

OR

0 1 1 11 0 0 01 1 0 10 0 1 01 1 1 01 1 1 00 0 0 1

12



L:

Can allow threshold gates too

OR

AND ANDAND

OR

0 1 1 11 0 0 01 1 0 10 0 1 01 1 1 01 1 1 00 0 0 1

12

A KP-ABE Scheme

13

A KP-ABE SchemeMPK: g, Y=e(g,g)y, T = (gt1,..., gtn) (n attributes)

13


MSK: ta for each attribute

13



Enc(m,A;s) = ( A, { Tas }a∈A, M.Ys )

13




SK for policy L (with d rows): Let u=(u1 ... ud) s.t. Σi ui = y. For each row i, let xi = <Li,u>/tlabel(i). Let Key = { gxi }i=1 to d

13





Dec ( (A,{Ua}a∈A,c); {Xi}row i) : Get Ys = Πi:label(i)∈A e(Ulabel(i),Xi)vi where v = [v1 ... vd] s.t. vi=0 if label(i) ∉ A, and vL=[1...1]

13







13







Choosing a random vector u for each key helps in preventing collusion

13

Predicate Encryption

14


Similar to ABE, but the ciphertext hides the attributes/policy

14



Decryption reveals only whether a condition is satisfied by the ciphertext, and if it is, reveals the message too

14




e.g.: ciphertext contains a vector c, and key a vector d. Predicate: whether <c,d> = 0 or not

14





A building block for other predicates

14





A building block for other predicates

Constructions using stronger (“non-standard”) assumptions

14

Attribute-Based Signatures

15


“Claim-and-endorse”: Claim to have attributes satisfying a certain policy, and sign a message

15



Soundness: can’t forge, even by colluding

15




Hiding: Verification without learning how the policy was satisfied

15




Hiding: Verification without learning how the policy was satisfied

Also unlinkable: cannot link multiple signatures as originating from the same signer

15

An ABS Construction

16

An ABS ConstructionUsing “Credential Bundles” and NIZK proofs (in fact, NIWI proofs)

16


Credential Bundle for a set of attributes:

16



Given multiple credential bundles, can’t create a credential bundle for a new set, unless it is a subset of attributes in a single given credential bundle

16




Map each (claim,message) to a “pseudo-attribute”

16





Signing key: credential bundle for (real) attributes possessed

16






Signature: a NIZK proof of knowledge of a credential-bundle for attributes satisfying the claim, or a credential for the pseudo-attribute corresponding to (claim,message)

16






Signature: a NIZK proof of knowledge of a credential-bundle for attributes satisfying the claim, or a credential for the pseudo-attribute corresponding to (claim,message)

Using conventional tools. More efficiently using bilinear pairings.

16

Today

17

Today

IBE, ABE and ABS

17

Today

IBE, ABE and ABS

Pairing-based cryptography

17

Today

IBE, ABE and ABS


Next up:

17

Today

IBE, ABE and ABS


Next up:

Some more applications of pairing-based cryptography

17

Today

IBE, ABE and ABS


Next up:

Some more applications of pairing-based cryptography

Generic groups

17

Documents

Attribute-Based Cryptography