Security analysis of a privacy‐preserving decentralized ciphertext‐policy attribute‐based encryption scheme

Abstract

As it does not require a central authority or the cooperation among multiple authorities, decentralized attribute-based encryption is an efficient and flexible multi-authority attribute-based encryption system. In most existing multi-authority attribute-based encryption schemes, a global identifier (GID) is introduced to act as the linchpin to resist collusion attacks. Because GID as well as some sensitive attributes used to apply for secret keys will lead to the compromise of user's privacy, some schemes towards solving these privacy issues have been proposed. Nevertheless, only the privacy of GID was considered in prior works. Recently in ESORICS 2014, Han et al. put forward a privacy-preserving decentralized ciphertext-policy attribute-based encryption scheme in the standard model to address the additive privacy of attributes. In their work, a privacy-preserving key extract protocol is presented to protect both user's identifier and attributes. In this paper, we point out the security weakness of the scheme of Han et al. We present a collusion attack on their basic decentralized ciphertext-policy attribute-based encryption scheme and additionally show that the privacy protection of attributes in their privacy-preserving key extract protocol cannot be provided. 1243 a security analysis and discussed two vulnerabilities of the scheme of Han et al. by presenting two attacks. The first is a collusion attack on their basic decentralized ciphertext-policy ABE schemes, and the second is an attack that allows the authority to recognize user's credentials, thus negating the protection of attributes. Consequently, it is still an interesting issue to construct a privacy-preserving decentralized attribute-based encryption scheme. APPENDIX A. DEFINITIONS OF DECENTRALIZED CIPHERTEXT-POLICY ATTRIBUTE-BASED ENCRYPTIONA decentralized ciphertext-policy attribute-based encryption scheme is composed of the following five algorithms: Global setup . / ! GP The global setup algorithm takes in the security parameter and outputs global parameters GP for the system. Authority setup .GP / ! SK; PK Each authority runs the authority setup algorithm with GP as input to produce its own secret key and public key pair SK; PK. Encrypt .M; .A; /; GP; ¹PKº/ ! C T The encryption algorithm takes in a message M , an access structure .A; /, the set of public keys for relevant authorities ¹PKº, and the global parameters GP . It outputs a ciphertext C T . KeyGen.GID; GP; i; SK/ ! K i;GID The key generation algorithm takes in an identity GID, the global parameters GP , an attribute i belonging to some authority, and the secret key SK for this authority. It produces a key K i;GID for this attribute, identity pair. Decrypt.C T; GP; ¹K i;GID º/ ! M The decryption algorithm takes in the global parameters GP , the ciphertext C T , and a collection of keys corresponding to attributes, identity pairs all with the same fixed identity GID. It outputs either the message M when the collection of attributes i satisfies the access structure corresponding to the cip...

A Framework of Multi-Authority Attribute-Based Encryption with Outsourcing and Revocation

“…It becomes a laborious task to reverse engineer the constructions and assert their security. Unfortunately, some are later shown to be insecure [10,14,27,22] …”

Privacy-preserving multi-authority attribute-based encryption with dynamic policy updating in PHR

“…Commitment schemes and zero-knowledge proof technology are introduced to protect the user's GID and attributes. However, note that it has been proved not to protect the user's attributes effectively in scheme [12]. Qian et al [13] proposed a privacypreserving personal health record scheme using multi-authority attribute-based encryption with revocation.…”

“…The schemes in [8,10,11] have privacy protection but they can't support policy updating. In the schemes in [8,12,17], only the privacy of the GID has been considered. Obviously, they can't protect the privacy of attributes.…”

“…This is the first scheme that considers the privacy of attributes. However, it has been proved in the scheme in [12] that the scheme proposed in [11] can't effectively protect the user's attributes. In our scheme, not only the privacy of GID has been considered, but also the attribute values are hidden in the access structure to prevent the attributes from being revealed to others.…”

Improving Security and Privacy-Preserving in Multi-Authorities Ciphertext-Policy Attribute-Based Encryption

“…Han et al [15] first proposed a scheme to address the privacy of attributes via anonymous protocol. Nevertheless, Wang et al [16] pointed out such solution was vulnerable to collusion attack and showed that the privacy-preserving key extract protocol from [15] didn't provide the privacy protection of attributes. Wang et al [16] didn't propose an improved scheme.…”