# Implementation of an Attribute-Based Encryption Scheme Based on SM9
## 2 Prerequisites and Overview  
BN-curves [26] are pairing-friendly curves with prime order and the embedding degree k of 12, which present great efficiency and security in the pairing process. The equation of a BN-curve is  
\[E:y^{2}=x^{3}+b,b\
eq 0 \tag{1}\]  
The trace (of Frobenius) of the curve [29], the curve order, and the characteristic of \(\mathrm{F_{q}}\) are parameterized as  
\[ \begin{split} t&=6x^{2}+1\\ n&=36x^{4}-36x^{3}+18x^{2}-6x+1\\ p&=36x^{4}-36x^{3}+24x^{2}-6x+1\end{split}  \tag{2}\]  
R-ate pairing [27] is a generalization of the Ate pairing. This pairing enables the loop length of [PERSON]'s algorithm [30] to be shorter than that of the Ate pairing. This makes the computation of pairing more efficient. Let \(\pi_{\mathrm{q}}\) be the Frobenius endomorphism, and \(t\) be the trace (of Frobenius) of the curve. For input \(Q\), \(P\), the R-ate pairing algorithm on the BN-curves is shown in Algorithm 1. ```
1\(s\gets 6t+2,s\leftarrow\sum\limits_{i=0}^{L-1}s_{i}2^{i},s_{i}\in[-1,0,1]\)
2\(T\gets Q,f\gets 1\)
3 For \(i=L-2\) to 0 Do
4\(f\gets f^{2}\cdot l_{T,T}(P);T\gets 2T\)
5 IF\(s_{i}=-1\)
6\(f\gets f\cdot l_{T,-Q}(P);T\gets T-Q\)
7 ELSE IF\(s_{i}=1\)
8\(f\gets f\cdot l_{T,Q}(P);T\gets T+Q\)
9 EndFor
10\(Q_{1}\leftarrow\pi_{q}(Q);Q_{2}\leftarrow\pi_{q^{2}}(Q)\)
11\(f\gets f\cdot l_{T,Q_{1}}(P);T\gets T+Q_{1}\)
12\(f\gets f\cdot l_{T-Q_{1}}(P);T\gets T-Q_{2}\)
13\(f\gets f^{(p^{2}-1)/r}\)
14 output\(f\)
```  
**Algorithm 1**\(R_{q}(Q,P)\)  
We have implemented the proposed ABE scheme and the SM9 IBE scheme in Java. The program can be easily deployed on a variety of platforms because of the strong portability of Java. The structure of the software is shown in Figure 1.  
The package api, package util, package pairing and package field are the packages provided by the Java Pairing-based Cryptography Library (JPBC). The package api provides interfaces that are related to pairing operations, such as the finite field, elliptic curves, and the pairing functions. The package util provides support for mathematical operations and so on. Package pairing and package field are the specific implementations of the interfaces that are exposed in package api. We construct extension of the finite field and the particular elliptic curve specified by the SM9 standard in the package pairing. We have also implemented the R-Ate pairing in this package. Sm9 Util is a static class, and it contains all of the supporting functions, such as KDF and H2 RF\({}_{\mathrm{i}}\) functions, which are detailed in Section 3.1. The supporting functions can be utilized by all other classes. The KeyGeneratorCenter class is designed following the singleton pattern, where the system parameters are stored. Moreover, it generates the Sm9 DecryptPrivateKey that corresponds to the user ID/attributes for decryption. The Sm9 Engine implements the SM9 hybrid encryption scheme. It contains three interfaces for users: initEncrypt, initDecrypt, and processBlock. The initEncrypt/initDecrypt function sets the ID/key for encryption/decryption. The processBlock function encrypts/decrypts the message after the initialization. Sm9 ABEngine implements an ABE scheme supporting AND-gate-only access structure, which will be introduced in Section 4, being based on the Sm9 Engine. The AND-gate-only access structure can be uniquely transformed to a user identity. The encryption and decryption processes of SM9 ABE include: (i) transforming the AND-gate-only access structure into a user Identity; and, (ii) invoking the functions that were provided by Sm9 Engine. Figure 1: The structure of attribute-based encryption (ABE) and identity-based encryption (IBE) Java implementation. Sm9 IBBEABEEnigne implements the ABE scheme that is presented in Section 4. Different from Sm9 ABEEnigne, Sm9 IBBEABEEnigne supports the generic access structure. A generic access structure, which is introduced in Section 4, is a generalization of the AND-gate-only access structure. The Sm9 IBBEABEEnigne has two functions: Encrypt and Decrypt.