# A CP-ABE Scheme Based on Lattice LWE and Its Security Analysis
## 3 Our Ciphertext-Policy ABE Scheme for NC\({}^{1}\) Circuits Based on LWE
### Security Analysis
The performance optimization, computational complexity, and implementation of the scheme will be considered at a later time. ### Example of Parameters Selection

In this section, we refer to the six constraints of the scheme parameters in the third section of this paper, and, after a series of strict calculations, we give several groups of reasonable parameter choices, which are not necessarily optimal, for detail, please refer to Table 3 as shown below. ### A Simple Example of CP-ABE

Here, we consider a non-monotone Boolean formula \((A\bigwedge B)\bigvee(C\bigwedge D)\), whose root has a 1-label (1, 0, 0, 0, 0) and a 0-label (0, 1, 0, 0, 0). According to the construction principle of generating matrix \(G\), we can determine that the policy is

\[G= \begin{pmatrix}0&0&0&1&0&A_{1}\\ 0&0&1&0&0&A_{0}\\ 1&0&0&-1&0&B_{1}\\ 0&0&1&-1&0&B_{0}\\ 0&0&0&0&1&C_{1}\\ 0&1&-1&0&0&C_{0}\\ 1&0&-1&0&-1&D_{1}\\ 0&1&-1&0&-1/D_{0}\end{pmatrix} \]

When the parameters \(t_{max}=5,|U|=8,\lambda=103,n=512,m=327,896,\epsilon=1/6\), \(\sigma=2580\), and \(\delta=1.1\times 10^{10}\) are selected, respectively, a series of operations are carried out according to the requirements of the four steps of the scheme design in Section 3.1 above because we can easily find a set of \(\{w_{i}\}_{i\in[8]}=(1,0,1,0,0,0,0)\) to make \(G_{i}w_{i}=(1,0,0,0,0)\). Because the ciphertext generated by encryption is \(\{c_{i}\}_{i\in[8]}\) and \(\{\hat{c}_{i}\}_{i\in[8]}\), therefore, according to the decryption algorithm, it can be calculated \(Y^{{}^{\prime}}=\sum_{i\in\Delta}\hat{c}_{i}(\mathbf{c}_{i}^{\top}\mathbf{h} _{i}+\mathbf{\hat{c}}_{i}^{\top}\mathbf{w})\). After a series of simplification, we can obtain \(Y^{{}^{\prime}}=\mathbf{s}\mathbf{x}^{\top}+\mathbf{e}_{1}^{\top}\mathbf{h}_{ \eta}(1)+\mathbf{\hat{c}}_{1}^{\top}\mathbf{+e}_{3}^{\top}\mathbf{h}_{\eta}( 3)+\mathbf{\hat{c}}_{3}^{\top}\mathbf{h}_{\eta}(3)+\mathbf{\hat{c}}_{3}^{\top} \mathbf{h}\). Through the \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Scheme** & **Public Key** & **Private Key** & **Ciphertext** & **Plaintex** \\ \hline \([20]\) & \(4|\mathbb{U}|mn\lceil\log_{2}q\rceil\) & \(2m|U|\lceil\log_{2}(|\sigma|+|\hat{B}|)\rceil\) & \(yt_{\max}\lceil\log_{2}3\rceil+4 my\lceil\log_{2}q\rceil\) & \(1\) \\ \hline Ours & \(2|\mathbb{U}|mn\lceil\log q\rceil\) & \(m|U|(\lceil\log_{2}(|\sigma|)\rceil+\lceil\log_{2}(|\sigma|+|\hat{\sigma}|))\) & \(yt_{\max}\lceil\log_{2}3\rceil+3 my\lceil\log_{2}q\rceil\) & \(1\) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison between our scheme and the scheme in [20] in terms of storage overhead under the same parameters. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \(\mathbf{f}_{max}\) & \(|\mathbb{U}|\) & \(\lambda\) & \(n\) & \(m\) & \(q\) & \(\epsilon\) & \(\sigma\) & \(\delta\) \\ \hline
1 * & 1 & 103 & 512 & 35,032 & \(2^{68}\) & 1/7 & 828 & \(2.988\times 10^{9}\) \\ \hline
1 * & 1 & 128 & 512 & 35,082 & \(2^{68}\) & 1/7 & 854 & \(3.835\times 10^{9}\) \\ \hline
8 & 10 & 103 & 512 & 327,896 & \(2^{80}\) & 1/6 & 2580 & \(1.1\times 10^{10}\) \\ \hline
8 & 20 & 103 & 512 & 327,896 & \(2^{80}\) & 1/6 & 2580 & \(1.1\times 10^{10}\) \\ \hline
10 & 15 & 192 & 1024 & 435,595 & \(2^{85}\) & 1/4 & 3048 & \(2.55\times 10^{11}\) \\ \hline
8 & 20 & 256 & 1024 & 737,803 & \(2^{90}\) & 1/10 & 4048 & \(7.646\times 10^{11}\) \\ \hline \hline \end{tabular}

* Note: The data in rows 1 and 2 are for reference only.

\end{table} 
Table 3: Recommended parameters in our CP-ABE scheme. calculation, it is found that \(\mathbf{e}_{1}^{\top}\mathbf{h}_{\eta(1)}+\mathbf{\hat{e}}_{1}^{\top}\mathbf{t}+ \mathbf{\hat{e}}_{3}^{\top}\mathbf{h}_{\eta(3)}+\mathbf{\hat{e}}_{3}^{\top} \mathbf{h}<2.65\times 10^{19}<q/4\); therefore, \(MSB(Y^{{}^{\prime}})=MSB(\mathbf{s}\mathbf{x}^{\top})\), so it can be decrypted successfully. ## 4 Conclusions

In this paper, the CP-ABE scheme of [20] is improved by using a two-stage sampling algorithm, and a selectively secure CP-ABE scheme with shorter ciphertext is obtained.