# A CP-ABE Scheme Based on Lattice LWE and Its Security Analysis
## 3 Our Ciphertext-Policy ABE Scheme for NC\({}^{1}\) Circuits Based on LWE
### Security Analysis
This is a step-by-step process, and, recently, there have been only a few exciting attempts, but these schemes themselves are not very efficient, and they are only attempts at the design level. There has not been too much consideration for specific contents, such as the key size or ciphertext size; therefore, here, we also make a comparison mainly from these levels, as shown below. The reason why we say that our scheme is at least the same as the scheme [20] under the same parameters is that we can prove that the scheme can indeed achieve selective security. However, also because the use of two-stage sampling technology has been proven able to achieve a strong security, simple function encryption. The so-called strong security means that attackers can decrypt key queries before and after arbitrary challenges are issued in simulated security experiments. Here, we only give proof that the scheme is selectively secure. At the same time, in order to better illustrate the contribution of this scheme, we compare our scheme with some previous CP-ABE schemes, as shown in Table 1 below. Here, under the same parameters, we make a simple comparison between our scheme and the one in [20] in terms of the public key, private key, and ciphertext storage overhead. The results show that the ciphertext can be shortened to a certain extent by two-stage sampling technology. The specific comparison idea is as follows. Since the lengths of parts \((\mathbf{G},\eta)\) and \(C=MSB(\mathbf{s}^{\top}\mathbf{x})\oplus\mu\) in the ciphertext of the two schemes are equal, we only compare parts \(\{\mathbf{c}_{i}\}_{i\in[y]}\) and \(\{\hat{\mathbf{c}}_{i}\}_{i\in[y]}\), as shown in Table 2 (since the value of the parameter \"m\" in our scheme is half that of the parameter \"m\" in their scheme, in order to make a unified comparison, we take the parameters in our scheme as the benchmark). In addition, \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Scheme** & **Circuits** & \begin{tabular}{c} **Access** \\ **Structure** \\ \end{tabular} & **Assumption** & \
\begin{tabular}{c} **Direct Design** \\ **or Indirect** \\ \end{tabular} &
\begin{tabular}{c} **Only Based on** \\ **LWE or Not** \\ \end{tabular} & **Security** \\ \hline
[9] & UC * & \
\begin{tabular}{c} Circuit \\ encoding of \\ BGG+ \\ \end{tabular} & LWE & Indirect & Yes &
\begin{tabular}{c} Lack \\ security proof \\ \end{tabular} \\ \hline
[6] & NC1 & \
\begin{tabular}{c} Circuit \\ encoding of \\ BGG+ \\ \end{tabular} &
\begin{tabular}{c} Bilinear maps \\ and LWE \\ \end{tabular} & Indirect & No & Ada-INDr \\ \hline
[21] & NC1 & A nearly LSSS & \
\begin{tabular}{c} LWE and \\ KOALA * \\ \end{tabular} & Indirect & No &
\begin{tabular}{c} Very \\ self-security \\ \end{tabular} \\ \hline
[22] & UC * & \
\begin{tabular}{c} Circuit \\ encoding of \\ BGG+ \\ \end{tabular} & LWE & Indirect & Yes &
[20] & NC1 & \begin{tabular}{c} LSSS (non- \\ monotone) \\ \end{tabular} & LWE & Direct & Yes & \begin{tabular}{c} Self-secure \\ \end{tabular} \\ \hline Ours & NC1 & \
\begin{tabular}{c} LSSS (non- \\ monotone) \\ \end{tabular} & LWE & Direct & Yes &
\begin{tabular}{c} (at least) \\ Self-secure \\ \end{tabular} \\ \hline \hline \end{tabular}

* Note *: The UC in the figure above represents the general-purpose circuit, and the KOALA represents knowledge of orthogonality assumption. Direct means that a scheme is constructed directly, while indirect indicates that a scheme needs to be transformed by borrowing other KP-ABE schemes or functional encryption schemes (FE).

\end{table} 
Table 1: Comparison with the construction of some previous LWE-based CP-ABE schemes. we also find that the sizes of the public key and private key of our scheme are superior to those of the original scheme. However, because the efficiencies of all LWE-based CP-ABEs are relatively low, we mainly pay attention to the innovation of the scheme design itself. However, some other contents, such as key size, encryption cost, decryption cost, and so on, will not be considered for the time being.