# A CP-ABE Scheme Based on Lattice LWE and Its Security Analysis
## 1 Introduction  
In order to better realize the fine-grained access control of encrypted data, attribute-based encryption comes into being as a generalization of traditional public key encryption [1]. Attribute encryption has two variants, including ciphertext strategy and key strategy. In the ciphertext policy ABE, that is, the ciphertext is associated with the access policy, and the key is correlated to the attribute. While in the key policy ABE, the position of the access policy and the attribute is exactly opposite. However, there is one consistent point: decryption will be successful only if the attribute meets the access policy. Since the concept of ABE was founded by [PERSON] et al. [2; 3], it has been widely studied in cryptography and has many potential applications. Therefore, cryptographic researchers all over the world have been widely concerned by the design of the ABE scheme, which has given birth to a series of achievements that, on the whole, pursue various tradeoffs between expression, efficiency, security, and potential assumptions [4; 5; 6; 7; 8; 9; 10; 11; 12; 13; 14; 15]. Most of the work mentioned above has been based on assumptions associated with bilinear mapping. It is necessary and normal to find structures based on other assumptions. On the one hand, they can not only make us more sure about the existence of the corresponding encryption scheme but also stimulate our enthusiasm for studying and developing new technologies, so as to further deepen our understanding of cryptographic primitives. On the other hand, in view of the known attacks of quantum computing on group-based cryptographic schemes [16], it is important to construct lattice-based attribute encryption to realize the security of quantum computing attacks. To this end, there are indeed several ABE schemes [4; 5; 8; 10; 11; 14; 17; 18; 19], which rely on other cryptographic assumptions rather than bilinear mappings as their underlying building blocks. However, it is an indisputable fact that most of the existing ABE schemes based on LWE are ABE with a key strategy. Until the advent of reference [20], only a few LWE-based CP-ABE schemes had been constructed, and all of them were obtained through a special transformation with the help of the KP-ABE. However, this transformation will inevitably lead to some unsatisfactory results. For more details, please refer to [20]. Under the assumption that there is only LWE, improving the CP-ABE structure based on the general-purpose circuits described above has always been a challenging problem. In order to solve this question, several eye-catching jobs have been completed recently. For example, the work of [6; 21; 22] depends on LWE and bilinear groups. Work [9] lacks a safety certificate. Recently, a CP-ABE project on the basis of LWE was constructed in [22], although an indispensable part of the scheme remained the general circuit size limit. Reference [20] makes a conceptual contribution to this open and challenging issue. Their excellent work also draws on some innovative ideas from the work of [17; 23]. In TCC 2013, [PERSON] et al. [17] proposed the first lattice-based attribute-based encryption construction (ABE) for NC\({}^{1}\) circuits. Unfortunately, soon after, a loophole was discovered in the security; however, because of its technical novelty, it continues to be widely studied by many scholars. In particular, this is the first lattice-based ABE that uses the linear secret sharing scheme (LSSS) as a key tool to implement access control. In the scheme [23], [PERSON] et al. proved that the scheme [17] is actually unsafe, and they gave an idea for repairing the security of the scheme by taking the notion of an admissible LSSS and instantiating it as the class of DNFs. After the work of [23], [PERSON] et al. proposed the first CP-ABE scheme constructed in a direct manner and provided the complete security proof. It is a very innovative and creative work; it not only introduces new methods and techniques in concept but also popularizes and constructs new MA-ABE schemes.