Short CCA-Secure Ciphertext-Policy
Attribute-Based Encryption
Hiroaki Anada

Seiko Arita

Department of Information Security
University of Nagasaki
Nagasaki, Japan
Email: anada@sun.ac.jp

Graduate School of Information Security
Institute of Information Security
Yokohama, Japan
Email: arita@iisec.ac.jp

Abstract—We propose a technique of individually modifying an
attribute-based encryption scheme (ABE) secure against chosenplaintext attacks (CPA) into an ABE scheme secure against
chosen-ciphertext attacks (CCA) in the standard model. We
demonstrate the technique in the case of the Waters ciphertextpolicy ABE (CP-ABE). Our technique is helpful when a DiffieHellman tuple to be verified is in the terminal group of abilinear map. We utilize the Twin Diffie-Hellman Trapdoor Testof Cash, Kiltz and Shoup, and it results in expansion of secret key
length and decryption cost of computation by a factor of four,
whereas public key length, ciphertext length and encryption costof computation remain almost the same. In the case that the sizeof attribute sets are small, those lengths and costs are smaller thanthose of the CP-ABE obtained via the generic transformation of
Yamada et al. in PKC 2011.

I. I NTRODUCTION
Attribute-based encryption (ABE) was first proposed by
Sahai and Waters [10] to realize fine-grained access control
by encryption, where attributes mean authorized credentials.
In ciphertext-policy ABE (CP-ABE) introduced by the subsequent work of Goyal, Pandey, Sahai and Waters [7], ciphertexts
are associated with access policies over attributes, while secretkeys are associated with sets of attributes. A secret key works
to decrypt a ciphertext if and only if the associated setof attributes satisfies the associated access policy. Since theproposal, it has been studied to attain certain properties suchas indistinguishability against chosen-plaintext attacks (INDCPA) in the standard model [11] and adaptive security against
adversary’s choice of a target access structure [9].
In this paper, we work through a problem of constructing
a shorter ABE scheme that attains indistinguishability against
chosen-ciphertext attacks (IND-CCA) in the standard model.
Let us recall the case of identity-based encryption (IBE). The
CHK transformation [4] is a generic tool for obtaining INDCCA secure IBE scheme. It transforms any hierarchical IBE(HIBE) scheme that is selective-ID IND-CPA secure into an
IBE scheme that is adaptive-ID IND-CCA secure. In contrast,
direct chosen-ciphertext security technique for IBE of Boyen,
Mei and Waters [3] is an individual technique for obtaining
an IND-CCA secure IBE scheme. It converts a HIBE schemethat is adaptive-ID IND-CPA secure into an IBE scheme thatis adaptive-ID IND-CCA secure. Though the technique needs
to treat each scheme individually, the obtained scheme attains

978-1-5090-6517-2/17/$31.00 ©2017 IEEE

better performance than that obtained by the generic tool (theCHK transformation). Let us transfer into the case of ABE.
The transformation of Yamada et al. [12] is a generic tool for
obtaining IND-CCA secure ABE scheme. It transforms any
ABE scheme that is IND-CPA secure into an ABE schemethat is IND-CCA secure. Notice here that developing direct
chosen-ciphertext security technique for ABE (in the standard
model) is a missing piece. One of the reason seems that there
is an obstacle that a Diffie Hellman tuple to be verified isin the terminal group of a bilinear map. In that situation, thebilinear map looks of no use.
A. Our Contribution
A first contribution is that we fill in the missing pieceof direct chosen-ciphertext security for ABE. We develop atechnique and apply it to the Waters CP-ABE scheme [11]to obtain IND-CCA security. A second technical contribution
is as follows. To overcome the above obstacle, we employ
and apply the Twin Diffie-Hellman Trapdoor Test of Cash,
Kiltz and Shoup [5]. In addition to that, we also utilize thealgebraic trick of Boneh and Boyen [2] and Kiltz [8] to reply
for adversary’s decryption query. In total, we develop thetechnique to realize direct chosen-ciphertext security.
B. Related Works
Waters [11] pointed out that IND-CCA security would
be attained by the CHK transformation. Gorantla, Boyd andNieto [6] constructed a IND-CCA secure CP-ABKEM in the
random oracle model. Yamada et al. [12] proposed a generictransformation of a IND-CPA secure ABE scheme into a INDCCA secure ABE scheme. Their transformation is considered
to be an ABE-version and versatile. Especially, it can beapplied to non-pairing-based scheme.
The Waters CP-ABE [11] can be captured as a CP-ABKEM:
the blinding factor can be considered as a random one-time
key. In addition, the CP-ABKEM is IND-CPA secure because
the Waters CP-ABE is proved to be IND-CPA secure. For
theoretical simplicity, we will provide a scheme of KEM first,
and then an encryption scheme.
C. Efficiency Comparison
We compare efficiency of our CP-ABKEM to the original
Waters CP-ABKEMcpa . We also compare efficiency of the CP-TABLE I
E FFICIENCY C OMPARISON OF IND- SEL -CCA SECURE CP-ABKEM S OBTAINED FROM THE WATERS CP-ABKEMCPA .
SchemeGeneric transform of Yamada et al. [12]
Our individual modification (CP-ABKEM)

𝐿(PK)+2𝜆2 (𝔾)+3(𝔾𝑇 )

𝐿(SK𝑆 )
+2𝜆2 (𝔾)×4𝐿(CT)+3𝜆2 (bit)+2(𝔾𝑇 )

𝐶(Encap)+2𝜆2 exp.(𝔾)+4exp.(𝔾𝑇 )𝐶(Decap)+2𝜆2 pair.(𝑒)×41) 𝐿(data) denotes length of data, 𝐶(algorithm) denotes computational amount of algorithm.
2) + and × mean increment and multiplier to the length or computational amount of the Waters CP-ABKEMcpa .
3) (𝔾), (𝔾𝑇 ) and (bit) mean elements in 𝔾, elements in 𝔾𝑇 and bits, respectively.
4) exp.(𝔾) and pair.(𝑒) mean a computational amount of one exponentiation in 𝔾 and one pairing computation by the map 𝑒, respectively.

ABKEM obtained by the generic transformation of Yamada
et al. [12]. Here the generic transformation [12] is consideredin the setting of small attribute universe [7], delegation caseand the Lamport one-time signature case. Table I shows thesecomparison. Our individual technique results in expansion of
secret key length and decryption cost of computation by afactor of four, while public key length, ciphertext length andencryption cost of computation are almost the same as those of
the Waters. In the case that the size of attribute sets are up to
the square of the security parameter 𝜆, lengths and costs of our
CP-ABKEM are smaller than those of the CP-ABE obtained
via the generic transformation of Yamada et al. [12].
II. P RELIMINARIESThe security parameter is denoted 𝜆. A prime of bit length
𝜆 is denoted 𝑝. A cyclic group of order 𝑝 is denoted 𝔾.
A. Bilinear Map
Let 𝔾 and 𝔾𝑇 be two cyclic groups of prime order 𝑝. Let 𝑔
be a generator of 𝔾 and 𝑒 be a bilinear map, 𝑒 : 𝔾×𝔾 → 𝔾𝑇 .
The bilinear map 𝑒 has the following properties: 1. Bilinearity:
for all 𝑢, 𝑣 ∈ 𝔾 and 𝑎, 𝑏 ∈ ℤ𝑝 , we have 𝑒(𝑢𝑎 , 𝑣 𝑏 ) = 𝑒(𝑢, 𝑣)𝑎𝑏 .
2. Non-degeneracy: 𝑒(𝑔, 𝑔) ∕= id𝔾𝑇 (: the identity element of
the group 𝔾𝑇 ). Parameters of a bilinear map are generated bya probabilistic polynomial time (PPT) algorithm Grp on input
𝜆: (𝑝, 𝔾, 𝔾𝑇 , 𝑔, 𝑒) ← Grp(𝜆). Hereafter we assume that thegroup operation in 𝔾 and 𝔾𝑇 and the bilinear map 𝑒 : 𝔾×𝔾 →𝔾𝑇 are computable in PT in 𝜆.
B. Access Structure
Let 𝒰 = {1, . . . , 𝑢} be a set of attributes. An accessstructure is defined as a collection 𝔸 of non-empty subsetsof 𝒰 ; that is, 𝔸 ⊂ 2𝒰 ∖{𝜙}. An access structure 𝔸 is called
monotone if for any 𝐵 ∈ 𝔸 and 𝐵 ⊂ 𝐶, 𝐶 ∈ 𝔸 holds. The
sets in 𝔸 are called authorized sets, and the sets not in 𝔸 are
called unauthorized sets. We will consider in this paper only
monotone access structures.
C. CP-ABKEM
A ciphertext-policy attribute-based key encapsulation mechanism (CP-ABKEM) consists of four PPT algorithms (Setup,
Encap, Keygen, Decap).
1) Setup(𝜆, 𝒰 ): A setup algorithm Setup takes as input
the security parameter 𝜆 and the attribute universe 𝒰 ={1, . . . , 𝑢}. In this paper, we assume the small universe case[7]. It returns a public key PK and a master secret key MSK.

2) Encap(PK, 𝔸): An encapsulation algorithm Encap
takes as input the public key PK and an access structure 𝔸. It
returns a random string 𝜅 and its encapsulation 𝜓.
3) KeyGen(PK, MSK, 𝑆): A key generation algorithm
KeyGen takes as input the public key PK, the master secretkey MSK and an attribute set 𝑆. It returns a secret key SK𝑆
corresponding to 𝑆.
4) Decap(PK, SK𝑆 , 𝜓): A decapsulation algorithm Decap
takes as input the public key PK, an encapsulation (we also callit a ciphertext according to context) 𝜓 and a secret key SK𝑆 .
It first checks whether 𝑆 ∈ 𝔸, where 𝑆 and 𝔸 are containedin SK𝑆 and 𝜓, respectively. If the check result is FALSE, it
puts 𝜅ˆ =⊥. It returns a decapsulation result 𝜅ˆ.
5) Chosen-Ciphertext Attack on CP-ABKEM [6]: A selective game on a target access structure (IND-sel-CCA game)is described as the following experiment of an adversary 𝒜.
Experimentind-sel-cca
𝒜,CP-ABKEM (𝜆, 𝒰 )𝔸∗ ← 𝒜(𝜆, 𝒰 ), (PK, MSK) ← Setup(𝜆, 𝒰 )𝜖 ← 𝒜KeyGen(PK,MSK,⋅),Decap(PK,SK⋅ ,⋅) (PK)(𝜅∗ , 𝜓 ∗ ) ← Encap(PK, 𝔸∗ ), 𝜅 ← KeySp(𝜆), 𝑏 ← {0, 1}
If 𝑏 = 1 then 𝜅˜ = 𝜅∗ else 𝜅˜=𝜅𝜅, 𝜓 ∗ )𝑏′ ← 𝒜KeyGen(PK,MSK,⋅),Decap(PK,SK⋅ ,⋅) (˜
If 𝑏′ = 𝑏 then return W IN else return L OSE.

Two kinds of queries are issued by 𝒜. One is key-extraction
queries. Indicating 𝑆𝑖 , 𝒜 queries its key-extraction oracle
KeyGen(PK, MSK, ⋅) for SK𝑆𝑖 . (We do not require 𝑆𝑖1 and𝑆𝑖2 to be distinct). Another is decapsulation queries. Indicating a pair (𝑆𝑗 , 𝜓𝑗 ), 𝒜 queries its decapsulation oracle Decap(PK, SK⋅ , ⋅) for the decapsulation 𝜅ˆ 𝑗 . An accessstructure 𝔸𝑗 , which is used to generate an encapsulation
𝜓𝑗 , is implicitly included in 𝜓𝑗 . In the case that 𝑆 ∕∈ 𝔸,𝜅ˆ 𝑗 =⊥ is replied to 𝒜. Both kinds of queries are at most𝑞k and 𝑞d times in total, respectively, which are polynomialin 𝜆. The access structure 𝔸∗ declared by 𝒜 is called atarget access structure. Two restrictions are imposed on 𝒜
concerning 𝔸∗ . In key-extraction queries, each attribute set/ 𝔸∗ . In decapsulation queries, each
𝑆𝑖 must satisfy 𝑆𝑖 ∈pair (𝑆𝑗 , 𝜓𝑗 ) must satisfy 𝑆𝑗 ∕∈ 𝔸∗ in the phase before
the declaration of 𝔸∗ and each pair (𝑆𝑗 , 𝜓𝑗 ) must satisfy
𝑆𝑗 ∕∈ 𝔸∗ ∨ 𝜓𝑗 ∕= 𝜓 ∗ in the phase after the declaration of𝔸∗ . The advantage of the adversary 𝒜 over CP-ABKEM in
the IND-CCA game is defined as: Advind-sel-cca
𝒜,CP-ABKEM (𝜆, 𝒰 ) =ind-sel-cca
Pr[Experiment𝒜,CP-ABKEM (𝜆, 𝒰 ) returns W IN]. CP-ABKEM

is called secure against chosen-ciphertext attacks if, for
any PPT adversary 𝒜 and for any attribute universe 𝒰 ,Advind-sel-cca
𝒜,CP-ABKEM (𝜆, 𝒰 ) is negligible in 𝜆. In the indistinguishability game against chosen-plaintext attack (IND-CPA game),
the adversary 𝒜 issues no decapsulation query (that is, 𝑞d = 0).
The advantage Advgame
𝒜,scheme (𝜆, 𝒰 ) of the adversary 𝒜 over ascheme in a game is defined in the same way as above.
6) Ciphertext-Policy Attribute-Based Encryption Scheme:
In the case of a ciphertext-policy attribute-based encryption
scheme (CP-ABE), Encap(PK, 𝔸) and Decap(PK, SK𝑆 , 𝜓)
are replaced by PPT algorithms Encrypt(PK, 𝔸, 𝑚) and
Decrypt(PK, SK𝑆 , CT), respectively, where 𝑚 and CT meana message and a ciphertext, respectively. The IND-CCA gamefor CP-ABE is defined in the same way as for CP-ABKEM
above, except the following difference. In Challenge phase, theadversary 𝒜 submits two equal length messages (plaintexts)
𝑚0 and 𝑚1 . Then the challenger flips a coin 𝑏 ∈ {0, 1} andgives an encryption result CT of 𝑚𝑏 to 𝒜. In Guess phase,the adversary 𝒜 returns 𝑏′ ∈ {0, 1}. If 𝑏′ = 𝑏, then 𝒜 wins in
the IND-CCA game. Otherwise, 𝒜 loses.
D. The Twin Diffie-Hellman TechniqueA 6-tuple (𝑔, 𝑋1 , 𝑋2 , 𝑌, 𝑍1 , 𝑍2 ) ∈ 𝔾6 is called atwin Diffie-Hellman tuple if the tuple is written as(𝑔, 𝑔 𝑥1 , 𝑔 𝑥2 , 𝑔 𝑦 , 𝑔 𝑥1 𝑦 , 𝑔 𝑥2 𝑦 ) for some elements 𝑥1 , 𝑥2 , 𝑦 in ℤ𝑝 .
In other words, a 6-tuple (𝑔, 𝑋1 , 𝑋2 , 𝑌, 𝑍1 , 𝑍2 ) is a twin
Diffie-Hellman tuple (twin DH tuple, for short) if 𝑌 = 𝑔 𝑦
and 𝑍1 = 𝑋1𝑦 and 𝑍2 = 𝑋2𝑦 . The following lemma of Cash,
Kiltz and Shoup will be used in the security proof to decide
whether a tuple is a twin DH tuple or not.
Lemma 1 (Cash, Kiltz and Shoup [5] “Trapdoor Test”):
Let 𝑋1 , 𝑟, 𝑠 be mutually independent random variables, where
𝑋1 takes values in 𝔾, and each of 𝑟, 𝑠 is uniformly distributed
over ℤ𝑝 . Define the random variable 𝑋2 = 𝑋1−𝑟 𝑔 𝑠 . Supposethat 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 are random variables taking values in 𝔾, eachof which is defined independently of 𝑟. Then the probability𝑟that the truth value of 𝑍ˆ1 𝑍ˆ2 = 𝑌ˆ 𝑠 does not agree with thetruth value of (𝑔, 𝑋1 , 𝑋2 , 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) being a twin DH tuple
is at most 1/𝑝. Moreover, if (𝑔, 𝑋1 , 𝑋2 , 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) is a twin𝑟
DH tuple, then 𝑍ˆ1 𝑍ˆ2 = 𝑌ˆ 𝑠 certainly holds.
Note that Lemma 1 is a statistical property. To be precise, we consider the following experiment of an algorithm Cheat with unbounded computational power, where
Cheat, given a triple (𝑔, 𝑋1 , 𝑋2 ), tries to generate a 6-tuple(𝑔, 𝑋1 , 𝑋2 , 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) that passes the “Trapdoor Test” though
it is not a twin DH tuple.

Now we are ready to complement Lemma 1.
Lemma 2 (a Complement to [5] “Trapdoor Test”):
For any algorithm Cheat with unbounded computational(𝜆) is at most 1/𝑝.
power, AdvtwinDH-test
Cheat,𝔾A proof of Lemma 2 is given in the full version paper [1].
III. S ECURING THE WATERS CP-ABKEM AGAINSTC HOSEN -C IPHERTEXT ATTACKSIn this section, we describe our direct chosen-ciphertext
security technique by applying it to the Waters CP-ABE [11].
1) Overview of Our Technique: The Waters CP-ABE isproved to be secure in the IND-sel-CPA game in [11]. We
convert it into a scheme that is secure in the IND-sel-CCA
game by employing the Twin Diffie-Hellman technique ofCash, Kiltz and Shoup [5] and the algebraic trick of Boneh andBoyen [2] and Kiltz [8]. In our encryption, a ciphertext become
to contain additional two elements (𝑑1 , 𝑑2 ), which function in
decryption as a “check sum” to verify that a tuple is certainly atwin DH tuple. In our security proof, the Twin Diffie-Hellman
Trapdoor Test does the function instead. It is noteworthy that
we can not use the bilinear map instead because the tuple tobe verified is in the terminal group. In addition, the algebraic
trick enables to answer for adversary’s decryption queries.
2) KEM and Encryption Scheme: The Waters CP-ABE
can be captured as a CP-ABKEM: the blinding factor of
the form 𝑒(𝑔, 𝑔)𝛼𝑠 in the Waters CP-ABE can be considered
as a random one-time key. So we call it the Waters CPABKEM hereafter and denote it as CP-ABKEMcpa . Likewise,
we distinguish parameters and algorithms of CP-ABKEMcpa
by the index cpa . For theoretical simplicity, we first develop a
KEM CP-ABKEM.
A. Our Construction

Our CP-ABKEM consists of the following four PPT algorithms (Setup, Encap, KeyGen, Decap). Roughly speaking,the Waters original scheme CP-ABKEMcpa (the first schemein [11]) corresponds to the case 𝑘 = 1 below excluding the“check sum” (𝑑1 , 𝑑2 ).
1) Setup(𝜆, 𝒰 ): Setup takes as input the security parameter 𝜆 and the attribute universe 𝒰 = {1, . . . , 𝑢}. It runs
Grp(𝜆) to get (𝑝, 𝔾, 𝔾𝑇 , 𝑔, 𝑒), where 𝔾 and 𝔾𝑇 are cyclic
groups of order 𝑝, 𝑒 : 𝔾 → 𝔾𝑇 is a bilinear map and 𝑔
is a generator of 𝔾. These become public parameters. Then
Setup takes 𝑢 random group elements ℎ1 , . . . , ℎ𝑢 ∈ 𝔾 thatare associated with the 𝑢 attributes. In addition, it chooses
random exponents 𝛼𝑘 ∈ ℤ𝑝 , 𝑘 = 1, . . . , 4, 𝑎 ∈ ℤ𝑝 anda hash key 𝜂 ∈ HKey(𝜆). The public key is published
twinDH-test
ExperimentCheat,𝔾 (𝜆)as PK = (𝑔, 𝑔 𝑎 , ℎ1 , . . . , ℎ𝑢 , 𝑒(𝑔, 𝑔)𝛼1 , . . . , 𝑒(𝑔, 𝑔)𝛼4 , 𝜂). The(𝑔, 𝑋1 ) ← 𝔾2 , (𝑟, 𝑠) ← ℤ2𝑝 , 𝑋2 = 𝑋1−𝑟 𝑔 𝑠
authority sets MSK = (𝑔 𝛼1 , . . . , 𝑔 𝛼4 ) as the master secret key.
32) Encap(PK, 𝔸): The encapsulation algorithm Encap
𝔾 ∋ (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) ← Cheat(𝑔, 𝑋1 , 𝑋2 )𝑟takes
as input the public key PK and an LSSS access structure𝑠
If 𝑍ˆ1 𝑍ˆ2 = 𝑌ˆ ∧ (𝑔, 𝑋1 , 𝑋2 , 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) is NOT a twin DH,
𝔸 = (𝑀, 𝜌), where 𝑀 is an 𝑙 × 𝑛 matrix and 𝜌 is the function
then return W IN else return L OSE
which maps each row 𝑖 of 𝑀 to an attribute in 𝒰 = {1, . . . , 𝑢}.
Encap first chooses a random value 𝑠 ∈ ℤ𝑝 that is the
Let us define the advantage of Cheat over 𝔾 as follows.
encryption exponent 𝑠 and random values 𝑦2 , . . . , 𝑦𝑛 ∈ ℤ𝑝 .
(𝜆) = Pr[ExperimenttwinDH-test(𝜆) returns W IN]. Then Encap forms a vector ⃗𝑣 = (𝑠, 𝑦2 , . . . , 𝑦𝑛 ). For 𝑖 = 1
AdvtwinDH-test
Cheat,𝔾
Cheat,𝔾

to 𝑙, it calculates 𝜆𝑖 = ⃗𝑣 ⋅ 𝑀𝑖 , where 𝑀𝑖 denotes the 𝑖-th
row vector of 𝑀 . In addition, Encap chooses random values
𝑟1 , . . . , 𝑟𝑙 ∈ ℤ𝑝 . Then, a pair of a random one-time key andits encapsulation (𝜅, 𝜓) is computed as follows.
𝑟𝑖𝑖
Put 𝐶 ′ = 𝑔 𝑠 ; For 𝑖 = 1 to 𝑙 : 𝐶𝑖 = 𝑔 𝑎𝜆𝑖 ℎ−𝑟
𝜌(𝑖) , 𝐷𝑖 = 𝑔 ;𝜓cpa = (𝔸, 𝐶 ′ , ((𝐶𝑖 , 𝐷𝑖 ); 𝑖 = 1, . . . , 𝑙)), 𝜏 ← 𝐻𝜂 (𝜓cpa );For 𝑘 = 1 to 4 : 𝜅𝑘 = 𝑒(𝑔, 𝑔)𝛼𝑘 𝑠 ; 𝑑1 = 𝜅𝜏1 𝜅3 , 𝑑2 = 𝜅𝜏2 𝜅4 ;(𝜅, 𝜓) = (𝜅1 , (𝜓cpa , 𝑑1 , 𝑑2 )).
3) KeyGen(MSK, PK, 𝑆): The key generation algorithm
KeyGen takes as input the master secret key MSK, the public
key PK and a set 𝑆 of attributes. KeyGen first chooses a
random 𝑡𝑘 ∈ ℤ𝑝 , 𝑘 = 1, . . . , 4. It creates the secret key SK𝑆
as follows.

1) Commit a Target Access Structure: ℬ is given (𝜆, 𝒰 ) as
inputs, where 𝜆 is the security parameter and 𝒰 = {1, . . . , 𝑢}is the attribute universe. ℬ invokes 𝒜 on (𝜆, 𝒰 ) and gets atarget access structure 𝔸∗ = (𝑀 ∗ , 𝜌∗ ) from 𝒜, where 𝑀 ∗ isof size 𝑙∗ × 𝑛∗ . ℬ uses 𝔸∗ as the target access structure ofitself and outputs 𝔸∗ .
2) Set up: In return to outputting 𝔸∗ , ℬ receives the public
key PKcpa for CP-ABKEMcpa , which consists of the following
components.
PKcpa = (𝑔, 𝑔 𝑎 , ℎ1 , . . . , ℎ𝑢 , 𝑒(𝑔, 𝑔)𝛼 ).
To set up a public key PK for CP-ABKEM, ℬ herein needsa challenge instance: ℬ queries its challenger and gets a∗). It consists of the following comchallenge instance (˜𝜅, 𝜓cpaponents.
∗

1 ⩽ 𝑘 ⩽ 4 : 𝐾𝑘 = 𝑔 𝛼𝑘 𝑔 𝑎𝑡𝑘 , 𝐿𝑘 = 𝑔 𝑡𝑘 , [𝑥 ∈ 𝑆 : 𝐾𝑘,𝑥 = ℎ𝑡𝑥𝑘 ];SK𝑆 = ((𝐾𝑘 , 𝐿𝑘 , (𝐾𝑘,𝑥 ; 𝑥 ∈ 𝑆)); 𝑘 = 1, . . . , 4).

𝜅˜ = 𝑒(𝑔, 𝑔)𝛼𝑠 OR a random one-time key 𝜅 ∈ KeySp(𝜆),4) Decap(PK, 𝜓, SK𝑆 ): The decapsulation algorithm Decap takes as input the public key PK, an encapsulation 𝜓 forthe access structure 𝔸 = (𝑀, 𝜌) and a private key SK𝑆 for an
attribute set 𝑆. It first checks whether 𝑆 ∈ 𝔸. If the result isˆ =⊥. else, let 𝐼𝑆 = 𝜌−1 (𝑆) ⊂ {1, . . . , 𝑙} and let
FALSE, put 𝜅{𝜔𝑖 ∈ ℤ𝑝 ; 𝑖 ∈ 𝐼𝑆 } be a set of linear reconstruction constants.
Then, the decapsulation 𝜅ˆ is computed as follows.

Then ℬ makes the rest of parameters of PK as follows.

Parse 𝜓 into (𝜓cpa = (𝔸, 𝐶 ′ , ((𝐶𝑖 , 𝐷𝑖 ); 𝑖 = 1, . . . , 𝑙)), 𝑑1 , 𝑑2 );𝜏 ← 𝐻𝜂 (𝜓cpa );′1 ⩽ 𝑘 ⩽ 4 : 𝜅ˆ𝑘 = 𝑒(𝐶 , 𝐾𝑘 )/= 𝑒(𝑔, 𝑔)𝛼𝑘 𝑠 ,∏(𝑒(𝐶𝑖 , 𝐿𝑘 )𝑒(𝐷𝑖 , 𝐾𝑘,𝜌(𝑖) ))

𝜔𝑖

𝑖∈𝐼𝑆

If 𝜅ˆ1 𝜏 𝜅ˆ3 ∕= 𝑑1 ∨ 𝜅ˆ2 𝜏 𝜅ˆ4 ∕= 𝑑2 , then put 𝜅ˆ =⊥, else put 𝜅ˆ = 𝜅ˆ1 .
B. Security and its Proof
Theorem 1: If the Waters CP-ABKEMcpa [11] is selectively
secure against chosen-plaintext attacks and an employed hashfunction family Hfam has target collision resistance, thenour CP-ABKEM is selectively secure against chosen-ciphertext
attacks. More precisely, for any given PPT adversary 𝒜
that attacks CP-ABKEM in the IND-sel-CCA game where
decapsulation queries are at most 𝑞d times, and for any
attribute universe 𝒰 , there exist a PPT adversary ℬ that attacks
CP-ABKEMcpa in the IND-sel-CPA game and a PPT target
collision finder 𝒞ℱ on Hfam that satisfy the following tight
reduction.
ind-sel-cpa
Advind-sel-cca
𝒜,CP-ABKEM (𝜆, 𝒰 ) ⩽Advℬ,CP-ABKEMcpa (𝜆, 𝒰 )𝑞d+Advtcr.
𝒞ℱ ,Hfam (𝜆) +𝑝

The definition of the target collision resistance game and theadvantage of 𝒞ℱ are given in [1].
Proof. Given any adversary 𝒜 that attacks our scheme
CP-ABKEM in the IND-sel-CCA game, we construct an adversary ℬ that attacks the Waters scheme CP-ABKEMcpa in the
IND-sel-CPA game as follows.

∗

∗
𝜓cpa
= (𝔸∗ , 𝐶 ′∗ = 𝑔 𝑠 , ((𝐶𝑖∗ , 𝐷𝑖∗ ); 𝑖 = 1, . . . , 𝑙∗ )).

∗);Pick up 𝜂 ← HKey(𝜆), take 𝜏 ∗ ← 𝐻𝜂 (𝜓cpa

Put 𝑒(𝑔, 𝑔)𝛼1 = 𝑒(𝑔, 𝑔)𝛼 ;Pick up 𝛾1 , 𝛾2 ← ℤ𝑝 , put 𝑒(𝑔, 𝑔)𝛼2 = 𝑒(𝑔, 𝑔)𝛾2 /𝑒(𝑔, 𝑔)𝛼1 𝛾1 ;∗Pick up 𝜇1 , 𝜇2 ← ℤ𝑝 , put 𝑒(𝑔, 𝑔)𝛼3 = 𝑒(𝑔, 𝑔)𝜇1 /𝑒(𝑔, 𝑔)𝛼1 𝜏 ,∗𝑒(𝑔, 𝑔)𝛼4 = 𝑒(𝑔, 𝑔)𝜇2 /𝑒(𝑔, 𝑔)𝛼2 𝜏 .
Note that we have set implicitly the following relations:
𝛼2 = 𝛾 2 − 𝛼1 𝛾1 , 𝛼3 = 𝜇1 − 𝛼1 𝜏 ∗ ,𝛼4 = 𝜇2 − 𝛼2 𝜏 ∗ = 𝜇2 − (𝛾2 − 𝛼1 𝛾1 )𝜏 ∗ .

(1)

A public key PK for CP-ABKEM become:PK = (PKcpa , 𝑒(𝑔, 𝑔)𝛼2 , 𝑒(𝑔, 𝑔)𝛼3 , 𝑒(𝑔, 𝑔)𝛼4 , 𝜂).
Then ℬ inputs PK into 𝒜. Note that PK determines thecorresponding MSK uniquely.
3) Phase 1: ℬ answers for two types of 𝒜’s queries asfollows.
(1) Key-Extraction Queries. In the case that 𝒜 issues a keyextraction query for an attribute set 𝑆 ⊂ 𝒰 , ℬ has to simulate
𝒜’s challenger. To do so, ℬ issues key-extraction queries toℬ’s challenger for 𝑆 repeatedly up to four times. As replies, ℬ
gets four secret keys of the Waters CP-ABKEMcpa for a single
attribute set 𝑆:
SKcpa,𝑆,𝑘 = (𝐾cpa,𝑘 , 𝐿cpa,𝑘 , (𝐾cpa,𝑘,𝑥 ; 𝑥 ∈ 𝒮)), 𝑘 = 1, . . . , 4.
We remark that, according to the randomness in the keygeneration algorithm of the Waters CP-ABKEMcpa , all four
secret keys SKcpa,𝑆,1 , . . . , SKcpa,𝑆,4 are random and mutuallyindependent. To reply a secret key SK𝑆 of our CP-ABKEM to
𝒜, ℬ converts the four secret keys as follows.
Put 𝐾1 = 𝐾cpa,1 ,𝐿1 = 𝐿cpa,1 , 𝐾1,𝑥 = 𝐾cpa,1,𝑥 , 𝑥 ∈ 𝑆;

−𝛾1,
Put 𝐾2 = 𝑔 𝐾cpa,2
𝜇1 −𝜏 ∗Put 𝐾3 = 𝑔 𝐾cpa,3 ,−𝛾1
1
𝐿2 = 𝐿−𝛾
cpa,2 , 𝐾2,𝑥 = 𝐾cpa,2,𝑥 , 𝑥 ∈ 𝑆;

𝛾2

∗

∗

∗

𝜏
𝐿3 = 𝐿−𝜏
cpa,3 , 𝐾3,𝑥 = 𝐾cpa,3,𝑥 , 𝑥 ∈ 𝑆;
∗

∗

∗

𝛾1 𝜏
𝛾1 𝜏
1𝜏
, 𝐿4 = 𝐿𝛾cpa,4, 𝐾4,𝑥 = 𝐾cpa,4,𝑥, 𝑥 ∈ 𝑆.
Put 𝐾4 = 𝑔 𝜇2 −𝛾2 𝜏 𝐾cpa,4Then ℬ replies SK𝑆 = ((𝐾𝑘 , 𝐿𝑘 , (𝐾𝑘,𝑥 ; 𝑥 ∈ 𝑆)); 𝑘 =1, . . . , 4) to 𝒜.
(2) Decapsulation Queries. In the case that 𝒜 issues adecapsulation query for (𝑆, 𝜓), where 𝑆 ⊂ 𝒰 is an attributeset and 𝜓 = (𝜓cpa , 𝑑1 , 𝑑2 ) is an encapsulation concerning 𝔸,ℬ has to simulate 𝒜’s challenger. To do so, ℬ computes thedecapsulation result 𝜅ˆ as follows.
If 𝑆 ∕∈ 𝔸 then put 𝜅ˆ =⊥,else Take 𝜏 ← 𝐻𝜂 (𝜓cpa );∗Put 𝑌ˆ = 𝑒(𝐶 ′ , 𝑔)𝜏 −𝜏 ,𝑍ˆ1 = 𝑑1 /𝑒(𝐶 ′ , 𝑔)𝜇1 , 𝑍ˆ2 = 𝑑2 /𝑒(𝐶 ′ , 𝑔)𝜇2 ;𝛾1
If 𝑍ˆ1 𝑍ˆ2 ∕= 𝑌ˆ 𝛾2 (: call this check T WIN DH-T EST)then put 𝜅ˆ = 𝜅ˆ1 =⊥else If 𝜏 = 𝜏 ∗ then abort (: call this case A BT)
else 𝜅
ˆ = 𝜅ˆ1 = 𝑍ˆ1

1/(𝜏 −𝜏 ∗ ).

Then ℬ replies 𝜅ˆ to 𝒜.
4) Challenge: In the case that 𝒜 queries its challenger fora challenge instance, ℬ makes a challenge instance as follows.
Put 𝑑∗1 = 𝑒(𝐶 ′∗ , 𝑔)𝜇1 , 𝑑∗2 = 𝑒(𝐶 ′∗ , 𝑔)𝜇2 ;∗Put 𝜓 ∗ = (𝜓cpa, 𝑑∗1 , 𝑑∗2 ).

Then ℬ feeds (˜𝜅, 𝜓 ∗ ) to 𝒜 as a challenge instance.
5) Phase 2: The same as in Phase 1.
6) Guess: In the case that 𝒜 returns 𝒜’s guess ˜𝑏, ℬ returns
˜𝑏 itself as ℬ’s guess.
In the above construction of ℬ, ℬ can perfectly simulate
the real view of 𝒜 until the case A BT happens, except for anegligible case, and hence the algorithm 𝒜 works as designed.
To see the perfect simulation with a negligible exceptionalcase, we are enough to prove the following seven claims.
Claim 1: The reply SK𝑆 = ((𝐾𝑘 , 𝐿𝑘 , (𝐾𝑘,𝑥 ; 𝑥 ∈ 𝑆)); 𝑘 =1, 2, 3, 4) for a key-extraction query is a perfect simulation.
Proof. We must consider the implicit relations (1). For the index 2, we have implicitly set the randomness 𝑡2 = 𝑡cpa,2 (−𝛾1 )−𝛾1and we get: 𝐾2 = 𝑔 𝛾2 𝐾cpa,2= 𝑔 𝛾2 (𝑔 𝛼1 𝑔 𝑎𝑡cpa,2 )−𝛾1 =−𝛾11𝑡cpa,2 −𝛾1)= 𝑔 𝑡2 , 𝐾2,𝑥 = 𝐾cpa,2,𝑥=𝑔 𝛼2 𝑔 𝑎𝑡2 , 𝐿2 = 𝐿−𝛾
cpa,2 = (𝑔𝑡cpa,2 −𝛾1𝑡2(ℎ𝑥 )= ℎ𝑥 , 𝑥 ∈ 𝑆. For the index 3 and 4, see [1]. □Claim 2: (𝑒(𝑔, 𝑔), 𝑒(𝑔, 𝑔)𝛼1 , 𝑒(𝑔, 𝑔)𝛼2 , 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) is a twin
Diffie-Hellman tuple if and only if (𝑒(𝑔, 𝑔), 𝑒(𝑔, 𝑔)𝛼1 𝜏𝑒(𝑔, 𝑔)𝛼3 , 𝑒(𝑔, 𝑔)𝛼2 𝜏 𝑒(𝑔, 𝑔)𝛼4 , 𝑒(𝐶 ′ , 𝑔), 𝑑1 , 𝑑2 ) is a twin
Diffie-Hellman tuple.
Proof. This claim can be proved by a short calculation. See[1].
□Claim 3: If (𝑒(𝑔, 𝑔), 𝑒(𝑔, 𝑔)𝛼1 , 𝑒(𝑔, 𝑔)𝛼2 , 𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) is atwin Diffie-Hellman tuple, then (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) certainly passes
𝛾1
the T WIN DH-T EST: 𝑍ˆ1 𝑍ˆ2 = 𝑌ˆ 𝛾2 .
Proof. This claim is a direct consequence of Lemma 1.
□
Claim 4: Consider the following event OVL𝑖 :Then, for at most 𝑞d times decapsulation queries of 𝒜, theprobability that at least one OVL𝑖 occurs is negligible in 𝜆.
More precisely, the following inequality holds:dPr[∨𝑞𝑖=1
OVL𝑖 ] ⩽ 𝑞d /𝑝.

(2)

Proof. To apply Lemma 2, we construct an algorithm Cheat𝜆,𝒰with unbounded computational power, which takes as input(𝑒(𝑔, 𝑔), 𝑒(𝑔, 𝑔)𝛼1 , 𝑒(𝑔, 𝑔)𝛼2 ) and returns (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) employing 𝒜 as a subroutine. Fig. 1 shows the construction.
Given (𝑒(𝑔, 𝑔), 𝑒(𝑔, 𝑔)𝛼1 , 𝑒(𝑔, 𝑔)𝛼2 ) as input :Set upInitialize the inner state and put TABLE = 𝜙;Get a target access structure 𝔸∗ ← 𝒜(𝜆, 𝒰 );Compute the base 𝑔 ∈ 𝔾 from (𝑒(𝑔, 𝑔), 𝑒);Pick up 𝑎 ∈ ℤ𝑝 and ℎ1 , . . . , ℎ𝑢 ∈ 𝔾;
Put PKcpa = (𝑔, 𝑔 𝑎 , ℎ1 , . . . , ℎ𝑢 , 𝑒(𝑔, 𝑔)𝛼1 );∗) ← Encapcpa (PKcpa , 𝔸∗ );Get (𝜅∗ , 𝜓cpa∗);
Pick up 𝜂 ← HKey(𝜆) and compute 𝜏 ∗ ← 𝐻𝜂 (𝜓cpa
Compute discrete logarithms 𝛼1 , 𝛼2 ∈ ℤ𝑝 of𝑒(𝑔, 𝑔)𝛼1 , 𝑒(𝑔, 𝑔)𝛼2 to the base 𝑒(𝑔, 𝑔);
Pick up 𝜇1 , 𝜇2 ← ℤ𝑝
and put 𝛼3 = 𝜇1 − 𝛼1 𝜏 ∗ , 𝛼4 = 𝜇2 − 𝛼2 𝜏 ∗ ;Put PK = (PKcpa , 𝑒(𝑔, 𝑔)𝛼2 , 𝑒(𝑔, 𝑔)𝛼3 , 𝑒(𝑔, 𝑔)𝛼4 , 𝜂),MSK = (𝑔 𝛼1 , 𝑔 𝛼2 , 𝑔 𝛼3 , 𝑔 𝛼4 ); Give PK to 𝒜;
Phase 1In the case 𝒜 makes a key-extraction query for 𝑆 ⊂ 𝒰 ;Reply SK𝑆 to 𝒜 in the same way as KeyGen using MSK;In the case 𝒜 makes a decapsulation query for(𝔸, 𝜓 = (𝜓cpa , 𝑑1 , 𝑑2 ), 𝑆);
Reply 𝜅ˆ to 𝒜 in the same way as Decap does using MSK;∗
Compute 𝑌ˆ = 𝑒(𝐶 ′ , 𝑔)𝜏 −𝜏 ,𝑍ˆ1 = 𝑑1 /𝑒(𝐶 ′ , 𝑔)𝜇1 , 𝑍ˆ2 = 𝑑2 /𝑒(𝐶 ′ , 𝑔)𝜇2 ;Update TABLE = TABLE ∪ (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 );Challenge
In the case 𝒜 makes a challenge instance query;Put 𝑑∗1 = 𝑒(𝐶 ′∗ , 𝑔)𝜇1 , 𝑑∗2 = 𝑒(𝐶 ′∗ , 𝑔)𝜇2 , 𝜓 ∗ =∗(𝜓cpa , 𝑑∗1 , 𝑑∗2 );Pick up 𝜅 ← KeySp(𝜆), 𝑏 ← {0, 1};
˜ = 𝜅;
If 𝑏 = 1 then put 𝜅˜ = 𝜅∗ else put 𝜅∗
Reply (˜𝜅, 𝜓 ) to 𝒜;
Phase 2The same as in Phase 1;
ReturnIn the case 𝒜 returns its guess 𝑏∗ ;Choose one triple (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) from TABLE at random;
Return (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ).
Fig. 1. An algorithm Cheat𝜆,𝒰 with unbounded computational power.

First, note that the view of 𝒜 in Cheat𝜆,𝒰 is the same as thereal view of 𝒜 and hence the algorithm 𝒜 works as designed.
Second, note that the return (𝑌ˆ , 𝑍ˆ1 , 𝑍ˆ2 ) of Cheat𝜆,𝒰 israndomized in TABLE. Hence:In the 𝑖-th T WIN DH-T EST, the following condition holds:
{
𝑞d
𝑞d
𝛾1
∑
1
1 ∑
𝑍ˆ1 𝑍ˆ2 = 𝑌ˆ 𝛾2 holds andPr[OVL𝑖 ] =Pr[OVL𝑖 ] = AdvtwinDH-test
Cheat𝜆,𝒰 ,𝔾 (𝜆). (3)𝑞𝑞𝛼1𝛼2 ˆ ˆ
d 𝑖=1(𝑒(𝑔, 𝑔), 𝑒(𝑔, 𝑔) , 𝑒(𝑔, 𝑔) , 𝑌 , 𝑍1 , 𝑍ˆ2 ) is NOT a twin DH. 𝑖=1 dThird, applying Lemma 2 to Cheat𝜆,𝒰 , we get:AdvtwinDH-test
Cheat𝜆,𝒰 ,𝔾 (𝜆) ⩽ 1/𝑝.

ACKNOWLEDGMENT(4)

Combining (3) and (4), we have:
𝑞d
∑
𝑞d
d
.□
Pr[∨𝑞𝑖=1
OVL𝑖 ] ⩽Pr[OVL𝑖 ] ⩽ 𝑞d AdvtwinDH-test
Cheat𝜆,𝒰 ,𝔾 (𝜆) ⩽𝑝𝑖=1Claim 5: The probability that OVL𝑖 never occurs in
T WIN DH-T EST for each 𝑖 and A BT occurs is negligible in
𝜆. More precisely, the following inequality holds:()
d¬OVL𝑖 ∧ A BT] ⩽ Advtcr(5)
Pr[ ∧𝑞𝑖=1
𝒞ℱ ,Hfam (𝜆).
Proof. This claim is proved by constructing a collision finder
𝒞ℱ on Hfam. See [1].
□Claim 6: The reply 𝜅ˆ to 𝒜 as an answer for a decapsulation
query is correct.
∗
Claim 7: The challenge instance 𝜓 ∗ = (𝜓cpa, 𝑑∗1 , 𝑑∗2 ) iscorrectly distributed.
Proof. These two claims are proved by a direct calculation.
See [1].
□
Now we are ready to evaluate the advantage of ℬ in the
IND-sel-CPA game. That 𝒜 wins in the IND-sel-CCA game∗means that (˜𝜅, 𝜓 ∗ = (𝜓cpa, 𝑑∗1 , 𝑑∗2 )) is correctly guessed. This∗
) is correctly guessed because
is equivalent to that (˜𝜅, 𝜓cpa∗∗
𝜓cpa determines the consistent blinding factor 𝜅∗ = 𝑒(𝑔, 𝑔)𝛼𝑠
uniquely. This means that ℬ wins in the IND-sel-CPA game.
Therefore, the probability that ℬ wins is equal to theprobability that 𝒜 wins, OVL𝑖 never holds in T WIN DH-T EST
for each 𝑖 and A BT never occurs. So we have:)(d¬OVL𝑖 ∧ (¬A BT)]Pr[ℬ wins] = Pr[(𝒜 wins) ∧ ∧𝑞𝑖=1)(()
d=Pr[𝒜 wins] − Pr[(𝒜 wins) ∧ ¬ ∧𝑞𝑖=1¬OVL𝑖 ∧ (¬A BT) ](())
d⩾Pr[𝒜 wins] − Pr[¬ ∧𝑞𝑖=1¬OVL𝑖 ∧ (¬A BT) ])(dd=Pr[𝒜 wins] − (Pr[∨𝑞𝑖=1
OVL𝑖 ] + Pr[ ∧𝑞𝑖=1¬OVL𝑖 ∧ A BT]).
Substituting (2), (5) and advantages into the above, we have:ind-sel-cca
Advind-sel-cpaℬ,CP-ABKEMcpa (𝜆, 𝒰 ) ⩾ Adv𝒜,CP-ABKEM (𝜆, 𝒰 )𝑞d− − Advtcr
𝒞ℱ ,Hfam (𝜆).
𝑝This is what we should prove in Theorem 1.

□

C. Encryption Version
It is straightforward to construct our encryption scheme
CP-ABE from CP-ABKEM. The IND-sel-CCA security of
CP-ABE is proved based on IND-sel-CPA security of theWaters KEM CP-ABKEMcpa . See [1].
IV. C ONCLUSIONS
We developed a technique of the so-called direct chosenciphertext security for ABE in the standard model in the case of
the Waters scheme (CP-ABKEMcpa , CP-ABEcpa ). We utilized
the Twin Diffie-Hellman Trapdoor Test of Cash, Kiltz andShoup and the algebraic trick of Boneh and Boyen [2] andKiltz [8]. Our technique is helpful when a Diffie-Hellman tuple
to be verified is in the terminal group of a bilinear map.

This work is partially supported by kakenhi Grant-in-Aid
for Scientific Research (C) JP15K00029 from Japan Society
for the Promotion of Science.
R EFERENCES[1] H. Anada and S. Arita, “Short cca-secure ciphertext-policy attributebased encryption,” the full version, to appear in IACR Cryptology ePrint
Archive, 2017.
[2] D. Boneh and X. Boyen, “Efficient selective-id secure identity-based
encryption without random oracles,” in Advances in Cryptology EUROCRYPT 2004, International Conference on the Theory andApplications of Cryptographic Techniques, Interlaken, Switzerland,
May 2-6, 2004, Proceedings, 2004, pp. 223–238. [Online]. Available:
http://dx.doi.org/10.1007/978-3-540-24676-3 14[3] X. Boyen, Q. Mei, and B. Waters, “Direct chosen ciphertext security
from identity-based techniques,” in Proceedings of the 12th ACM
Conference on Computer and Communications Security, CCS 2005,
Alexandria, VA, USA, November 7-11, 2005, 2005, pp. 320–329.
[Online]. Available: http://doi.acm.org/10.1145/1102120.1102162[4] R. Canetti, S. Halevi, and J. Katz, “Chosen-ciphertext security
from identity-based encryption,” in Advances in Cryptology EUROCRYPT 2004, International Conference on the Theory andApplications of Cryptographic Techniques, Interlaken, Switzerland,
May 2-6, 2004, Proceedings, 2004, pp. 207–222. [Online]. Available:
http://dx.doi.org/10.1007/978-3-540-24676-3 13[5] D. Cash, E. Kiltz, and V. Shoup, “The twin diffie-hellman problem
and applications,” in Advances in Cryptology - EUROCRYPT
2008, 27th Annual International Conference on the Theory andApplications of Cryptographic Techniques, Istanbul, Turkey, April
13-17, 2008. Proceedings, 2008, pp. 127–145. [Online]. Available:
http://dx.doi.org/10.1007/978-3-540-78967-3 8[6] M. C. Gorantla, C. Boyd, and J. M. G. Nieto, “Attribute-based
authenticated key exchange,” in Information Security and Privacy 15th Australasian Conference, ACISP 2010, Sydney, Australia, July
5-7, 2010. Proceedings, 2010, pp. 300–317. [Online]. Available:
http://dx.doi.org/10.1007/978-3-642-14081-5 19[7] V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-based
encryption for fine-grained access control of encrypted data,” inProceedings of the 13th ACM Conference on Computer andCommunications Security, CCS 2006, Alexandria, VA, USA, Ioctober
30 - November 3, 2006, 2006, pp. 89–98. [Online]. Available:
http://doi.acm.org/10.1145/1180405.1180418[8] E. Kiltz, “Chosen-ciphertext security from tag-based encryption,” inTheory of Cryptography, Third Theory of Cryptography Conference,
TCC 2006, New York, NY, USA, March 4-7, 2006, Proceedings, 2006, pp.
581–600. [Online]. Available: http://dx.doi.org/10.1007/11681878 30[9] A. B. Lewko, T. Okamoto, A. Sahai, K. Takashima, and B. Waters,“Fully secure functional encryption: Attribute-based encryption and(hierarchical) inner product encryption,” in Advances in Cryptology- EUROCRYPT 2010, 29th Annual International Conference on the
Theory and Applications of Cryptographic Techniques, French Riviera,
May 30 - June 3, 2010. Proceedings, 2010, pp. 62–91. [Online].
Available: http://dx.doi.org/10.1007/978-3-642-13190-5 4[10] A. Sahai and B. Waters, “Fuzzy identity-based encryption,” in Advancesin Cryptology - EUROCRYPT 2005, 24th Annual International
Conference on the Theory and Applications of Cryptographic
Techniques, Aarhus, Denmark, May 22-26, 2005, Proceedings, 2005, pp.
457–473. [Online]. Available: http://dx.doi.org/10.1007/11426639 27[11] B. Waters, “Ciphertext-policy attribute-based encryption: An expressive,
efficient, and provably secure realization,” in Public Key Cryptography- PKC 2011 - 14th International Conference on Practice andTheory in Public Key Cryptography, Taormina, Italy, March 69, 2011. Proceedings, 2011, pp. 53–70. [Online]. Available: http://dx.doi.org/10.1007/978-3-642-19379-8 4[12] S. Yamada, N. Attrapadung, G. Hanaoka, and N. Kunihiro, “Genericconstructions for chosen-ciphertext secure attribute based encryption,”in Public Key Cryptography - PKC 2011 - 14th International
Conference on Practice and Theory in Public Key Cryptography,
Taormina, Italy, March 6-9, 2011. Proceedings, 2011, pp. 71–89.
[Online]. Available: http://dx.doi.org/10.1007/978-3-642-19379-8 5