# Verifiable Outsourced Decryption of Attribute-Based Encryption with Constant Ciphertext Length

Authors: Jiguo Li; Fengjie Sha; Yichen Zhang; Xinyi Huang; Jian Shen
Journal: Security and Communication Networks
 (2017)

---

## Abstract

Outsourced decryption ABE system largely reduces the computation cost for users who intend to access the encrypted files stored in cloud. However, the correctness of the transformation ciphertext cannot be guaranteed because the user does not have the original ciphertext. Lai et al. provided an ABE scheme with verifiable outsourced decryption which helps the user to check whether the transformation done by the cloud is correct. In order to improve the computation performance and reduce communication overhead, we propose a new verifiable outsourcing scheme with constant ciphertext length. To be specific, our scheme achieves the following goals.(1) Our scheme is verifiable which ensures that the user efficiently checks whether the transformation is done correctly by the CSP. (2) The size of ciphertext and the number of expensive pairing operations are constant, which do not grow with the complexity of the access structure. (3) The access structure in our scheme is AND gates on multivalued attributes and we prove our scheme is verifiable and it is secure against selectively chosen-plaintext attack in the standard model. (4) We give some performance analysis which indicates that our scheme is adaptable for various limited bandwidth and computation-constrained devices, such as mobile phone.


---

## Body

## 1. Introduction

Attribute-based encryption (ABE) derives from identity-based encryption (IBE) introduced in [1]. A user’s identity in IBE system is indicated by a binary bit string and the corresponding representation in ABE system is extended to an attribute set. The identity represented by an attribute set is not unique so ABE can realize the one-to-many encryption. Traditional IBE schemes can only provide coarse-grained access control. In order to solve this problem, Goyal et al. [2] presented a new scheme in which the fine-grained access control is associated with the user’s private keys and ciphertexts are associated with a descriptive attribute set. ABE can be divided into two categories, namely, key-policy attribute-based encryption (KP-ABE) [2–4] and ciphertext-policy attribute-based encryption (CP-ABE) [5–11]. One of the main defects of current ABE schemes is expensive decryption operation for mobile device with low computing power and limited battery. To improve efficiency, Green et al. [12] presented an efficient ABE scheme by outsourcing expensive decryption operation to the cloud service provider (CSP). In their scheme, a user uses proxy reencryption method [13, 14] to generate a transformation key and sends the transformation key and ABE ciphertext to the CSP. Given the transformation key, the CSP transforms an ABE ciphertext into a simple ciphertext, from which the user recovers plaintext by using less computation overhead. In this process, the CSP does not get any information about original plaintext. Chase [15] extended single authority ABE to propose a multiauthority ABE scheme. However, he only proves that the scheme is secure against the selective ID model. Liu et al. [16] provided a fully secure multiauthority CP-ABE. In order to protect privacy of the user, Han et al. [17] presented a decentralized key-policy attribute-based encryption with preserving privacy. Qian et al. [18] provided a decentralized CP-ABE with fully hidden access structure. Furthermore, they [19] proposed a privacy-preserving personal health record using multiauthority ABE with revocation. Several traceable CP-ABE schemes [20–22] were constructed to trace the identity of a misbehaving user who leaks its decryption key to others and thus reduces the trust assumptions on both users and attribute authorities. Recently, Li et al. [23] presented flexible and fine-grained attribute-based data storage in cloud computing. To protect data privacy, the sensitive data should be encrypted by the data owner prior to outsourcing. As the amount of encrypted files stored in cloud is becoming very huge, searchable encryption scheme over encrypted cloud data is a very challenging issue. To deal with above problem, Li et al. [24, 25] proposed a new cryptographic primitive called attribute-based encryption scheme with keyword search function [26–28]. In the proposed scheme, cloud service provider (CSP) performs partial decryption task delegated by data user without knowing anything about the plaintext. Moreover, the CSP can perform encrypted keyword search without knowing anything about the keywords embedded in trapdoor. In order to protect the privacy for the encryptor and decryptor, Li et al. [29] propose a CP-ABE scheme with hidden access policy and testing.Our Motivations and Contributions. With the cloud service being more and more popular in modern society, ABE technology has become a promising orientation. It allows users to use flexible access control to access files stored in the cloud server with encrypted form. Though its advantages make it a powerful tool for cloud, one of its main performance challenges is that the complexity of decryption computation is linearly correlated with the access structure. By using the proxy reencryption technology, outsourced decryption ABE system can largely reduce the computation cost for users who intend to access the encrypted files stored in cloud. Given a ciphertext and a transformation key, CSP transforms a ciphertext into a simple ciphertext. The user only needs to spend less computational overhead to recover the plaintext from simple ciphertext. However, the correctness of the transformation ciphertext which the CSP gives to the user cannot be guaranteed because the latter does not have the original ciphertext. It is a security threat that malicious cloud service provider (CSP) may replace the original ciphertext and give the user a transformed ciphertext from another ciphertext which CSP wants the user to decrypt. The user is not aware of the CSP’s malicious behavior. Mutual verifiable provable data auditing [30] in public cloud storage is a potential method to solve remote data possession checking. The security property about ABE with outsourcing decryption ensures that the malicious cloud server cannot obtain anything with respect to the encrypted message; nonetheless, the scheme does not ensure the validity of the transformation done by the CSP. In order to solve this problem, Lai et al. [31] put forward an ABE scheme with verifiable outsourcing decryption which guarantees verifiability of the transformation. Recently, Li et al. [32] presented an outsourcing ABE scheme which can check validity of the outsourced computation results. There is no doubt that verifiability brings about great progress to outsourced decryption of ABE. However, the ciphertext length and the amount of expensive pairing computations grow with the number of the attributes, which greatly limits its application in power constrained and bandwidth limited devices. Schemes in [33, 34] put forward a good solution to this problem in which the ciphertext length is constant. In this article, we present a novel verifiable outsourced CP-ABE scheme with constant ciphertext length to save the communication cost. The security of our scheme reduces to that of scheme in [33]. Similar to the proof in [31], the verifiability of our scheme reduces to the discrete logarithm assumption.Organization. We organized the rest of the paper as follows. In Section 2, we review some preliminary knowledge and introduce the CP-ABE model of outsourced decryption. We also give the security definitions used in our paper in this section. In Section 3, we provide a new verifiable outsourced CP-ABE scheme with constant ciphertext length. We prove security and verifiability of our scheme in Section 4. In Section 5, we give some performance comparison with the existing schemes. Finally, we conclude the paper in Section 6.


## 2. Preliminaries

We introduce some basic knowledge about bilinear groups, security assumption, access structure, and CP-ABE which our scheme relies on.


### 2.1. Bilinear Pairing

Definition 1 (bilinear map).
G 1 and GT are multiplicative cyclic groups with prime order p. Suppose g is a generator in G1. e:G1×G1→GT is bilinear map if it satisfies the following properties: (1)
Bilinearity: for allu,v∈G1, e(ua,vb)=e(u,v)ab, where a,b∈Zp are selected randomly.(2)
Nondegeneracy: there existsu,v∈G1 such that e(u,v)≠1.(3)
Computability: for allu,v∈G1, there is an efficient algorithm to compute e(u,v).


### 2.2. Security Assumption

Definition 2 (discrete logarithm (DL) assumption [31]).
Let(p,G,GT,e) be a prime-order bilinear group system. Given (p,G,GT,e,g,gx), where g∈G is randomly selected, the DL problem for (p,G,GT,e) is to calculate x. The DL assumption in (p,G,GT,e) is that no probabilistic polynomial-time (PPT) algorithm A solves the DL problem at nonnegligible advantage. The advantage for A is defined as Pr⁡[A(p,G,GT,e,g,gx)=x].


### 2.3. Access Structure

Access structure is being referred to in [33]; we utilize AND gates with respect to multivalued attributes as follows.Definition 3.
Assume thatU=att1,…,attn is an attribute universe. Vi=vi,1,vi,2,…,vi,ni are some feasible values, where ni is the amount of feasible values of atti∈U. Let S=[S1,S2,…,Sn], let Si∈Vi be an attribute set for a user, and A=[A1,A2,…,An]; let Ai∈Vi be an access structure. The notation S⊨A denotes that an attribute set S satisfies an access structure A; that is to say, Si=Ai(i=1,2,…,n).


### 2.4. Outline of CP-ABE with Outsourced Decryption

Briefly speaking, a user interacts with the CSP as illustrated in Figure1. Data owner encrypts message M into ciphertext CT and uploads it to the storage in cloud. A user who is permitted to access the data downloads the ciphertext. Then the user sends the ciphertext and transformation key to the CSP for outsourcing decryption. CSP computes partially decrypted ciphertext CT′ and sends it to the user. The user computes the message from the partially decrypted ciphertext and verifies whether the message is the original one.Figure 1
System architecture of our scheme.We review the notion of CP-ABE in [31] with outsourced decryption. It is described by the seven algorithms as follows.S e t u p ( λ , U ). This algorithm takes the security parameter λ and attribute universe U as input. It outputs public parameter PK and master secret key MK.K e y G e n ( P K , M K , S ). This algorithm takes PK, MK, and attribute set S as input. It outputs private key SKS related to S.E n c r y p t ( P K , M , A ). This algorithm takes PK, message M, and access structure A as input and outputs ciphertext CT.D e c r y p t ( P K , S K S , C T ). This algorithm takes PK, SKS, and CT as input. It outputs M if SKS associated with S satisfies A.G e n T K o u t ( P K , S K S ). This algorithm takes PK and SKS as input. It outputs transformation key TKS associated with S and a corresponding retrieving key RKS.T r a n s f o r m o u t ( P K , C T , T K S ). This algorithm takes PK, CT, and TKS as input. It outputs a partially decrypted ciphertext CT′.D e c r y p t o u t ( P K , C T , C T ′ , R K S ). This algorithm takes PK, CT, CT′, and RKS for S as input. It outputs message M or ⊥.


### 2.5. Security Model for CP-ABE with Outsourcing Decryption

Lai et al. [31] described security properties and verifiability for CP-ABE which supports outsourcing decryption. The traditional concept of security for chosen-ciphertext attack (CCA) is not suitable for the above CP-ABE scheme because it does not permit modifying any bit for the ciphertext. Therefore, they use a relaxation named replayed CCA (RCCA) security [35], which permits alternation for the ciphertext, so that they can change the potential message in a significant way.


#### 2.5.1. Security

The RCCA security of outsourced decryption CP-ABE is described as a game in both an adversary and a challenger. According to the game in [31], it is described as follows.Setup. The challenger C performs setup algorithm to get the public parameter PK and master secret key MK. It sends PK to the adversary A and keeps MK secret.Query Phase 1. The challenger maintains a table Tb and a set D which are initialized empty. The adversary A adaptively issues queries.(1) Private Key Query for Attribute Set S. The challenger runs SKS←KeyGen(PK,MK,S) and sets D=D∪S. It then sends the private key SKS to the adversary.(2) Transformation Key Query on Attribute Set S. C scans the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it returns TKS as the transformation key. Otherwise, it runs SKS←KeyGen(PK,MK,S) and (TKS,RKS)←GenTKout(PK,SKS) and stores the tuple in table Tb. It then returns the transformation key TKS to the adversary.Without loss of generality, we suppose that an adversary does not launch transformation key query for attribute setS, if a private key query about the same attribute set S has been issued. Since anyone can generate a transformation key of the user utilizing the user’s private key and GenTKout algorithm by himself, the assumption is rational.(3) Decryption Query for Attribute Set S and Ciphertext C T. C runs SKS←KeyGen(PK,MK,S) and M←Decrypt(PK,SKS,CT). It sends M to the adversary.(4) D e c r y p t i o n o u t Query for Attribute Set S and Ciphertext ( C T , C T ′ ). C searches the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it runs algorithm M←Decryptout(PK,CT,CT′,RKS) and returns M to C; otherwise, it returns ⊥.Challenge. A sends M0 and M1 with equal length and an access policy A∗ to C subject to the restriction that, for all S∈D, A∗ cannot be satisfied by S. The challenger chooses b∈0,1 and computes CT∗=Encrypt(PK,Mb,A∗). Then the challenger sends the challenge ciphertext CT∗ to A.Query Phase 2. A proceeds to adaptively launch transformation key, decryption, Decryptionout, and private key queries as in phase 1 with the following restrictions:(1)
A cannot make private key query which results in attribute set S that satisfies the target access policy A∗.(2)
A cannot issue any trivial decryption queries. Namely, Decryptionout and decryption queries are replied to as phase 1; if the response is either M0 or M1, then C returns ⊥.Guess. The adversary A gives a guess b′∈{0,1} for b and succeeds in the game if b′=b.Pr ⁡ b ′ = b - 1 / 2 is defined as the advantage for the adversary A in the game.Definition 4.
An outsourcing decryption CP-ABE scheme is RCCA secure if all probabilistic polynomial-time (PPT) adversaries have at most a negligible advantage of winning in this game.CPA Security. An outsourcing decryption CP-ABE scheme is secure under chosen-plaintext attack (CPA) if A cannot launch decryption queries in the above game.Selective Security. An outsourcing decryption CP-ABE scheme is selective security if we add an initialization phase prior to setup algorithm in above game, where the adversary gives the challenger access structure A∗.


#### 2.5.2. Verifiability

The verifiability for CP-ABE with outsourced decryption is depicted via a game in both an adversary and a challenger. The game proceeds as follows.Setup. C performs algorithm setup to generate the public parameters PK and master secret key MSK. It returns PK to A and keeps MSK secret.Query Phase 1. C initializes an empty table T. A adaptively issues the following queries.(1) Private Key Query for Attribute Set S. C runs SKS←KeyGen(PK,MK,S) and returns the private key SKS to the adversary.(2) Transformation Key Query for Attribute Set S. The challenger runs SKS←KeyGen(PK,MK,S) and (TKS,RKS)←GenTKout(PK,SKS) and stores the entry (S,SKS,TKS,RKS) in table T. It then returns the transformation key TKS to the adversary.Without loss of generality, we suppose that the adversary does not launch transformation key query for attribute setS, if a private key query about the same attribute set S has been issued. Anyone can generate a transformation key of the user utilizing the user’s private key and GenTKout algorithm by himself.(3) Decryption Query for Attribute Set S and a Ciphertext C T. C runs SKS←KeyGen(PK,MK,S) and M←Decrypt(PK,SKS,CT). It sends M to C.(4) D e c r y p t i o n o u t Query for Attribute Set S and Ciphertexts ( C T , C T ′ ). C searches the tuple (S,SKS,TKS,RKS) in table T. If such a tuple exists, it runs M←Decryptout(PK,CT,CT′,RKS) and returns M to C; otherwise, it returns ⊥.Challenge. A sends challenge message M∗ and challenge access policy A∗ to the challenger C. C computes CT∗=Encrypt(PK,M∗,A∗) and returns CT∗ to A as its challenge ciphertext.Query Phase 2. A proceeds to adaptively launch transformation key, decryption, Decryptionout, and private key queries as in phase 1.Output. A returns attribute set S∗ and transformed ciphertext CT∗′. We suppose that tuple (S∗,SKS∗,TKS∗,RKS∗) is included in table T. Otherwise, the challenger generates the tuple as the reply for transformation key query. A succeeds in the game if Decryptout(PK,CT∗,CT∗′,RKS∗)∉{M∗,⊥}.Definition 5.
An outsourcing decryption CP-ABE scheme is verifiable if PPT adversary has at most a negligible advantage in the above game.


## 2.1. Bilinear Pairing

Definition 1 (bilinear map).
G 1 and GT are multiplicative cyclic groups with prime order p. Suppose g is a generator in G1. e:G1×G1→GT is bilinear map if it satisfies the following properties: (1)
Bilinearity: for allu,v∈G1, e(ua,vb)=e(u,v)ab, where a,b∈Zp are selected randomly.(2)
Nondegeneracy: there existsu,v∈G1 such that e(u,v)≠1.(3)
Computability: for allu,v∈G1, there is an efficient algorithm to compute e(u,v).


## 2.2. Security Assumption

Definition 2 (discrete logarithm (DL) assumption [31]).
Let(p,G,GT,e) be a prime-order bilinear group system. Given (p,G,GT,e,g,gx), where g∈G is randomly selected, the DL problem for (p,G,GT,e) is to calculate x. The DL assumption in (p,G,GT,e) is that no probabilistic polynomial-time (PPT) algorithm A solves the DL problem at nonnegligible advantage. The advantage for A is defined as Pr⁡[A(p,G,GT,e,g,gx)=x].


## 2.3. Access Structure

Access structure is being referred to in [33]; we utilize AND gates with respect to multivalued attributes as follows.Definition 3.
Assume thatU=att1,…,attn is an attribute universe. Vi=vi,1,vi,2,…,vi,ni are some feasible values, where ni is the amount of feasible values of atti∈U. Let S=[S1,S2,…,Sn], let Si∈Vi be an attribute set for a user, and A=[A1,A2,…,An]; let Ai∈Vi be an access structure. The notation S⊨A denotes that an attribute set S satisfies an access structure A; that is to say, Si=Ai(i=1,2,…,n).


## 2.4. Outline of CP-ABE with Outsourced Decryption

Briefly speaking, a user interacts with the CSP as illustrated in Figure1. Data owner encrypts message M into ciphertext CT and uploads it to the storage in cloud. A user who is permitted to access the data downloads the ciphertext. Then the user sends the ciphertext and transformation key to the CSP for outsourcing decryption. CSP computes partially decrypted ciphertext CT′ and sends it to the user. The user computes the message from the partially decrypted ciphertext and verifies whether the message is the original one.Figure 1
System architecture of our scheme.We review the notion of CP-ABE in [31] with outsourced decryption. It is described by the seven algorithms as follows.S e t u p ( λ , U ). This algorithm takes the security parameter λ and attribute universe U as input. It outputs public parameter PK and master secret key MK.K e y G e n ( P K , M K , S ). This algorithm takes PK, MK, and attribute set S as input. It outputs private key SKS related to S.E n c r y p t ( P K , M , A ). This algorithm takes PK, message M, and access structure A as input and outputs ciphertext CT.D e c r y p t ( P K , S K S , C T ). This algorithm takes PK, SKS, and CT as input. It outputs M if SKS associated with S satisfies A.G e n T K o u t ( P K , S K S ). This algorithm takes PK and SKS as input. It outputs transformation key TKS associated with S and a corresponding retrieving key RKS.T r a n s f o r m o u t ( P K , C T , T K S ). This algorithm takes PK, CT, and TKS as input. It outputs a partially decrypted ciphertext CT′.D e c r y p t o u t ( P K , C T , C T ′ , R K S ). This algorithm takes PK, CT, CT′, and RKS for S as input. It outputs message M or ⊥.


## 2.5. Security Model for CP-ABE with Outsourcing Decryption

Lai et al. [31] described security properties and verifiability for CP-ABE which supports outsourcing decryption. The traditional concept of security for chosen-ciphertext attack (CCA) is not suitable for the above CP-ABE scheme because it does not permit modifying any bit for the ciphertext. Therefore, they use a relaxation named replayed CCA (RCCA) security [35], which permits alternation for the ciphertext, so that they can change the potential message in a significant way.


### 2.5.1. Security

The RCCA security of outsourced decryption CP-ABE is described as a game in both an adversary and a challenger. According to the game in [31], it is described as follows.Setup. The challenger C performs setup algorithm to get the public parameter PK and master secret key MK. It sends PK to the adversary A and keeps MK secret.Query Phase 1. The challenger maintains a table Tb and a set D which are initialized empty. The adversary A adaptively issues queries.(1) Private Key Query for Attribute Set S. The challenger runs SKS←KeyGen(PK,MK,S) and sets D=D∪S. It then sends the private key SKS to the adversary.(2) Transformation Key Query on Attribute Set S. C scans the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it returns TKS as the transformation key. Otherwise, it runs SKS←KeyGen(PK,MK,S) and (TKS,RKS)←GenTKout(PK,SKS) and stores the tuple in table Tb. It then returns the transformation key TKS to the adversary.Without loss of generality, we suppose that an adversary does not launch transformation key query for attribute setS, if a private key query about the same attribute set S has been issued. Since anyone can generate a transformation key of the user utilizing the user’s private key and GenTKout algorithm by himself, the assumption is rational.(3) Decryption Query for Attribute Set S and Ciphertext C T. C runs SKS←KeyGen(PK,MK,S) and M←Decrypt(PK,SKS,CT). It sends M to the adversary.(4) D e c r y p t i o n o u t Query for Attribute Set S and Ciphertext ( C T , C T ′ ). C searches the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it runs algorithm M←Decryptout(PK,CT,CT′,RKS) and returns M to C; otherwise, it returns ⊥.Challenge. A sends M0 and M1 with equal length and an access policy A∗ to C subject to the restriction that, for all S∈D, A∗ cannot be satisfied by S. The challenger chooses b∈0,1 and computes CT∗=Encrypt(PK,Mb,A∗). Then the challenger sends the challenge ciphertext CT∗ to A.Query Phase 2. A proceeds to adaptively launch transformation key, decryption, Decryptionout, and private key queries as in phase 1 with the following restrictions:(1)
A cannot make private key query which results in attribute set S that satisfies the target access policy A∗.(2)
A cannot issue any trivial decryption queries. Namely, Decryptionout and decryption queries are replied to as phase 1; if the response is either M0 or M1, then C returns ⊥.Guess. The adversary A gives a guess b′∈{0,1} for b and succeeds in the game if b′=b.Pr ⁡ b ′ = b - 1 / 2 is defined as the advantage for the adversary A in the game.Definition 4.
An outsourcing decryption CP-ABE scheme is RCCA secure if all probabilistic polynomial-time (PPT) adversaries have at most a negligible advantage of winning in this game.CPA Security. An outsourcing decryption CP-ABE scheme is secure under chosen-plaintext attack (CPA) if A cannot launch decryption queries in the above game.Selective Security. An outsourcing decryption CP-ABE scheme is selective security if we add an initialization phase prior to setup algorithm in above game, where the adversary gives the challenger access structure A∗.


### 2.5.2. Verifiability

The verifiability for CP-ABE with outsourced decryption is depicted via a game in both an adversary and a challenger. The game proceeds as follows.Setup. C performs algorithm setup to generate the public parameters PK and master secret key MSK. It returns PK to A and keeps MSK secret.Query Phase 1. C initializes an empty table T. A adaptively issues the following queries.(1) Private Key Query for Attribute Set S. C runs SKS←KeyGen(PK,MK,S) and returns the private key SKS to the adversary.(2) Transformation Key Query for Attribute Set S. The challenger runs SKS←KeyGen(PK,MK,S) and (TKS,RKS)←GenTKout(PK,SKS) and stores the entry (S,SKS,TKS,RKS) in table T. It then returns the transformation key TKS to the adversary.Without loss of generality, we suppose that the adversary does not launch transformation key query for attribute setS, if a private key query about the same attribute set S has been issued. Anyone can generate a transformation key of the user utilizing the user’s private key and GenTKout algorithm by himself.(3) Decryption Query for Attribute Set S and a Ciphertext C T. C runs SKS←KeyGen(PK,MK,S) and M←Decrypt(PK,SKS,CT). It sends M to C.(4) D e c r y p t i o n o u t Query for Attribute Set S and Ciphertexts ( C T , C T ′ ). C searches the tuple (S,SKS,TKS,RKS) in table T. If such a tuple exists, it runs M←Decryptout(PK,CT,CT′,RKS) and returns M to C; otherwise, it returns ⊥.Challenge. A sends challenge message M∗ and challenge access policy A∗ to the challenger C. C computes CT∗=Encrypt(PK,M∗,A∗) and returns CT∗ to A as its challenge ciphertext.Query Phase 2. A proceeds to adaptively launch transformation key, decryption, Decryptionout, and private key queries as in phase 1.Output. A returns attribute set S∗ and transformed ciphertext CT∗′. We suppose that tuple (S∗,SKS∗,TKS∗,RKS∗) is included in table T. Otherwise, the challenger generates the tuple as the reply for transformation key query. A succeeds in the game if Decryptout(PK,CT∗,CT∗′,RKS∗)∉{M∗,⊥}.Definition 5.
An outsourcing decryption CP-ABE scheme is verifiable if PPT adversary has at most a negligible advantage in the above game.


## 2.5.1. Security

The RCCA security of outsourced decryption CP-ABE is described as a game in both an adversary and a challenger. According to the game in [31], it is described as follows.Setup. The challenger C performs setup algorithm to get the public parameter PK and master secret key MK. It sends PK to the adversary A and keeps MK secret.Query Phase 1. The challenger maintains a table Tb and a set D which are initialized empty. The adversary A adaptively issues queries.(1) Private Key Query for Attribute Set S. The challenger runs SKS←KeyGen(PK,MK,S) and sets D=D∪S. It then sends the private key SKS to the adversary.(2) Transformation Key Query on Attribute Set S. C scans the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it returns TKS as the transformation key. Otherwise, it runs SKS←KeyGen(PK,MK,S) and (TKS,RKS)←GenTKout(PK,SKS) and stores the tuple in table Tb. It then returns the transformation key TKS to the adversary.Without loss of generality, we suppose that an adversary does not launch transformation key query for attribute setS, if a private key query about the same attribute set S has been issued. Since anyone can generate a transformation key of the user utilizing the user’s private key and GenTKout algorithm by himself, the assumption is rational.(3) Decryption Query for Attribute Set S and Ciphertext C T. C runs SKS←KeyGen(PK,MK,S) and M←Decrypt(PK,SKS,CT). It sends M to the adversary.(4) D e c r y p t i o n o u t Query for Attribute Set S and Ciphertext ( C T , C T ′ ). C searches the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it runs algorithm M←Decryptout(PK,CT,CT′,RKS) and returns M to C; otherwise, it returns ⊥.Challenge. A sends M0 and M1 with equal length and an access policy A∗ to C subject to the restriction that, for all S∈D, A∗ cannot be satisfied by S. The challenger chooses b∈0,1 and computes CT∗=Encrypt(PK,Mb,A∗). Then the challenger sends the challenge ciphertext CT∗ to A.Query Phase 2. A proceeds to adaptively launch transformation key, decryption, Decryptionout, and private key queries as in phase 1 with the following restrictions:(1)
A cannot make private key query which results in attribute set S that satisfies the target access policy A∗.(2)
A cannot issue any trivial decryption queries. Namely, Decryptionout and decryption queries are replied to as phase 1; if the response is either M0 or M1, then C returns ⊥.Guess. The adversary A gives a guess b′∈{0,1} for b and succeeds in the game if b′=b.Pr ⁡ b ′ = b - 1 / 2 is defined as the advantage for the adversary A in the game.Definition 4.
An outsourcing decryption CP-ABE scheme is RCCA secure if all probabilistic polynomial-time (PPT) adversaries have at most a negligible advantage of winning in this game.CPA Security. An outsourcing decryption CP-ABE scheme is secure under chosen-plaintext attack (CPA) if A cannot launch decryption queries in the above game.Selective Security. An outsourcing decryption CP-ABE scheme is selective security if we add an initialization phase prior to setup algorithm in above game, where the adversary gives the challenger access structure A∗.


## 2.5.2. Verifiability

The verifiability for CP-ABE with outsourced decryption is depicted via a game in both an adversary and a challenger. The game proceeds as follows.Setup. C performs algorithm setup to generate the public parameters PK and master secret key MSK. It returns PK to A and keeps MSK secret.Query Phase 1. C initializes an empty table T. A adaptively issues the following queries.(1) Private Key Query for Attribute Set S. C runs SKS←KeyGen(PK,MK,S) and returns the private key SKS to the adversary.(2) Transformation Key Query for Attribute Set S. The challenger runs SKS←KeyGen(PK,MK,S) and (TKS,RKS)←GenTKout(PK,SKS) and stores the entry (S,SKS,TKS,RKS) in table T. It then returns the transformation key TKS to the adversary.Without loss of generality, we suppose that the adversary does not launch transformation key query for attribute setS, if a private key query about the same attribute set S has been issued. Anyone can generate a transformation key of the user utilizing the user’s private key and GenTKout algorithm by himself.(3) Decryption Query for Attribute Set S and a Ciphertext C T. C runs SKS←KeyGen(PK,MK,S) and M←Decrypt(PK,SKS,CT). It sends M to C.(4) D e c r y p t i o n o u t Query for Attribute Set S and Ciphertexts ( C T , C T ′ ). C searches the tuple (S,SKS,TKS,RKS) in table T. If such a tuple exists, it runs M←Decryptout(PK,CT,CT′,RKS) and returns M to C; otherwise, it returns ⊥.Challenge. A sends challenge message M∗ and challenge access policy A∗ to the challenger C. C computes CT∗=Encrypt(PK,M∗,A∗) and returns CT∗ to A as its challenge ciphertext.Query Phase 2. A proceeds to adaptively launch transformation key, decryption, Decryptionout, and private key queries as in phase 1.Output. A returns attribute set S∗ and transformed ciphertext CT∗′. We suppose that tuple (S∗,SKS∗,TKS∗,RKS∗) is included in table T. Otherwise, the challenger generates the tuple as the reply for transformation key query. A succeeds in the game if Decryptout(PK,CT∗,CT∗′,RKS∗)∉{M∗,⊥}.Definition 5.
An outsourcing decryption CP-ABE scheme is verifiable if PPT adversary has at most a negligible advantage in the above game.


## 3. Construction of Our New Scheme

Our new scheme consists of seven algorithms.S e t u p ( 1 k ). A trusted authority (TA) picks two bilinear groups (G1,GT) of prime-order p, g1∈G1, h,u,v,d∈G1, y∈RZp, and ti,j∈RZp(i∈[1,n],j∈[1,ni]). H:GT→Zp∗ is a hash function. TA computes Y=e(g1,h)y; Ti,j=g1ti,j(i∈[1,n],j∈[1,ni]). It generates PK=(e,g1,h,u,v,d,Y,{Ti,j}i∈[1,n],j∈[1,ni],H) as public parameters and MK=(y,{ti,j}i∈[1,n],j∈[1,ni]) as master secret key. Note that, ∀S,S′(S≠S′), ∑vi,j∈Sti,j≠∑vi,j∈S′ti,j is assumed.K e y G e n ( P K , M S K , S ). TA selects r∈RZp, computes K1=hy(g1∑vi,j∈Sti,j)r and K2=g1r, and sends SKS=(K1,K2) to a user associated with attribute set S.E n c r y p t ( P K , M , A ). An encryptor randomly selects s,s′∈RZp; M~∈GT. He calculates C^=uH(M)vH(M~)d, C1=M·Ys, C2=g1s,C3=(∏vi,j∈ATi,j)s, C1′=M~·Ys′, and C2′=g1s′,C3′=(∏vi,j∈ATi,j)s′. The sender generates CT=(A,C^,C1,C2,C3,C1′,C2′,C3′).D e c r y p t ( P K , S K S , C T ). A decryptor calculates as follows:(1)C1·eC3,K2eC2,K1=M·eg1,hsyeg1∑vi,j∈Ati,js,g1reg1s,hyg1∑vi,j∈Sti,jr=M·eg1,hsyeg1,g1sr∑vi,j∈Ati,jeg1,hsyeg1,g1sr∑vi,j∈Sti,j=M,C1′·eC3′,K2eC2′,K1=M~·eg1,hs′yeg1∑vi,j∈Ati,js′,g1reg1s′,hyg1∑vi,j∈Sti,jr=M~·eg1,hs′yeg1,g1s′r∑vi,j∈Ati,jeg1,hs′yeg1,g1s′r∑vi,j∈Sti,j=M~.IfC^=uH(M)vH(M~)d, it outputs the message M; otherwise, it outputs ⊥.G e n T K o u t ( P K , S K S ). A user generates his transformation key pair as follows. He chooses z∈RZp and computes the transformation key as TKS=(K1′,K2′), where K1′=K11/z and K2′=K21/z. The retrieving key is RKS=z. Note that, with overwhelming probability, z has multiplicative inverse.T r a n s f o r m o u t ( P K , C T , T K S ). Given ciphertext CT and transformation key TKS, the CSP computes as follows: (2)eC2,K1′eC3,K2′=eg1s,hy/zg1∑vi,j∈Sti,jr/ze∏vi,j∈ATi,js,g1r/z=eg1,hsy/zeg1,g1sr/z∑vi,j∈Sti,jeg1,g1sr/z∑vi,j∈Ati,j=eg1,hsy/z=T′,eC2′,K1′eC3′,K2′=eg1s′,hy/zg1∑vi,j∈Sti,jr/ze∏vi,j∈ATi,js′,g1r/z=eg1,hs′y/zeg1,g1s′r/z∑vi,j∈Sti,jeg1,g1s′r/z∑vi,j∈Ati,j=eg1,hs′y/z=T′′,and it outputs the transformed ciphertext as CT′=(T^=C^,T1=C1,T1′=C1′,T′,T′′).D e c r y p t o u t ( P K , C T , C T ′ , R K S ). A user checks whether the transformed ciphertext T^≠C^ or T1≠C1 or T1′≠C1′; if the equations do not hold, he outputs ⊥. Otherwise, he computes M=C1/T′z and M~=C1′/T′′z. If T^=uH(M)vH(M~)d, he outputs the message M; otherwise, he outputs ⊥.Note that∑vi,j∈Sti,j≠∑vi,j∈S′ti,j according to assumption. If there exist S and S′ such that ∑vi,j∈Sti,j=∑vi,j∈S′ti,j, the user with attribute set S′ is able to decrypt ciphertext related to A, where S′⊭A, S⊨A, and S≠S′. We have that the assumption holds with overwhelming probability:(3)pp-1⋯p-N-1pN>p-N-1NpN=1-N-1pN>1-NN-1p>1-N2p,where N=∏i=1nni. If we randomly choose ti,j∈Zp as secret key, then our assumption is reasonable.


## 4. Security Proof

Note that, in our scheme, a ciphertext consists of three parts:(C1,C2,C3), (C1′,C2′,C3′), and C^. The first two elements are ciphertexts for message M and random message M~, respectively, utilizing the encryption algorithm [33]. In essence, the second and the third elements are redundant information. The redundant information is mainly used to design a CP-ABE scheme with verifiable outsourcing decryption from [33], which has been proven to be selectively CPA-secure. We denote the first four algorithms as Basic CP-ABE. To guarantee the security for our scheme, we firstly prove that if the scheme in [33] is selectively CPA-secure, then Basic CP-ABE scheme is selectively CPA-secure.Theorem 6.
Assume that the scheme in [33] is selectively CPA-secure. Then the Basic CP-ABE scheme is also selectively CPA-secure.Proof.
We prove that our Basic CP-ABE scheme is selectively CPA-secure by the following two games.
G a m e 0. Game0 is the originally selective CPA security game.
G a m e 1. In Game1, the challenger randomly selects C^∈G1 and generates the remaining parts of the challenge ciphertext CT=(A,C^,C1,C2,C3,C1′,C2′,C3′) as in Game0.This theorem is proven via the following lemmas. Lemma7 shows that Game0 and Game1 are indistinguishable. Lemma 8 shows that the advantage for an adversary in Game1 is negligible. Thus, we come to a conclusion that the advantage for an adversary in Game0 is negligible. Theorem 6 is correct from the two lemmas below.Lemma 7.
Assume that the scheme in [33] is selectively CPA-secure; Game0 and Game1 are computationally indistinguishable.Proof.
If the adversaryA is able to distinguish Game0 and Game1 at nonnegligible advantage, then we find an algorithm B which attacks the scheme [33] under the selective CPA security model at nonnegligible advantage.
LetC be the challenger for the selective CPA security game in scheme [33]. B and the adversary A interact as follows.
Init. A gives A∗ to B as its challenge access policy. B sends A∗ to C as its challenge access policy. C sends the public parameters PK′=(e,g1,h,Y,{Ti,j}i∈[1,n],j∈[1,ni]) of the scheme [33] to B.
Setup. B selects x,y,z∈RZp and computes u=g1x, v=g1y, and d=g1z. B also selects hash function H:GT→Zp∗. B sends PK=(e,g1,h,u,v,d,Y,{Ti,j}i∈[1,n],j∈[1,ni],H) to the adversary A.
Query Phase 1. A adaptively launches private key query on attribute set Si; then B gets the private key SKSi via calling key generation oracle of C with respect to Si. B returns the private key SKSi to A.
Challenge. A sends two equal size messages M0,M1 to B as the challenge plaintext. B selects a random bit β and random messages M~0,M~1∈GT. B sends M~0,M~1∈GT and A∗ to C. C randomly selects γ∈{0,1}; the message M~γ is encrypted by PK′ and A∗ using the encryption algorithm in [32] and sends the resulting ciphertext CT∗′ to B. B denotes CT∗′ as CT∗′=(A∗,C1′,C2′,C3′). B selects s∈RZp and computes C^=uH(Mβ)vH(M^β)d, C1=Mβ·Ys, C2=g1s, and C3=(∏vi,j∈ATi,j)s and sends CT∗=(A∗,C^,C1,C2,C3,C1′,C2′,C3′) to A as its challenge ciphertext.
Query Phase 2. A adaptively launches private key query as in phase 1. B answers the queries as in phase 1.
Guess. A gives a guess β′∈{0,1} of B. B outputs β′ as a guess of γ.
Note that ifβ=γ, B appropriately simulates Game0; else, B appropriately simulates Game1. Therefore, if A is able to distinguish Game0 and Game1 at nonnegligible advantage, we are able to find an algorithm B that attacks the scheme [33] in selective CPA security model at nonnegligible advantage.Lemma 8.
Assume that the CP-ABE scheme in [33] is selectively CPA-secure; the advantage for the adversary A on Game1 is negligible.Proof.
If the adversaryA has a nonnegligible advantage in Game1, then we can find an algorithm B which attacks the scheme [33] at a nonnegligible advantage.
LetC be the challenger with respect to B of the scheme [33]. B interacts with A as demonstrated in the following steps.
Init. A submits challenge access policy A∗ to B. B gives A∗ to C as its challenge access policy. C returns PK′=(e,g1,h,Y,{Ti,j}i∈[1,n],j∈[1,ni]) of scheme [25] to B as public parameters.
Setup. B chooses x,y,z∈RZp and sets u=g1x, v=g1y, and d=g1z. H:GT→Zp∗ is a secure hash function. B sends PK=(e,g1,h,u,v,d,Y,{Ti,j}i∈[1,n],j∈[1,ni],H) to the adversary A.
Query Phase 1. A adaptively launches private key query of attribute set Si; B gets the private key SKSi via calling key generation oracle of C with respect to Si. B sends the private key SKSi to A.
Challenge. A submits messages M0,M1 with equal size. B sends M0,M1 and A∗ to C. C randomly chooses γ∈{0,1}; the message Mγ is encrypted by PK′ and A∗ using the encryption algorithm in [33] and sends the resulting ciphertext CT∗′ to B. B parses CT∗′ as CT∗′=(A∗,C1,C2,C3). B selects s′∈RZp, M~∈RGT, and C^∈RG1 and computes C1′=M~·Ys′, C2′=g1s′, and C3′=(∏vi,j∈ATi,j)s′. B sends CT∗=(A∗,C^,C1,C2,C3,C1′,C2′,C3′) to A as its challenge ciphertext.
Query Phase 2. A adaptively launches private key query as in phase 1. B answers the queries as in phase 1.
Guess. A gives a guess β′∈{0,1} on B. B returns β′ as its guess for γ. Obviously, B has appropriately simulated Game1. If A has a nonnegligible advantage in Game1, then B attacks the scheme in [33] at a nonnegligible advantage.
Now we have proven that the Basic CP-ABE scheme is selectively CPA-secure. After that we prove that if Basic CP-ABE scheme is selectively CPA-secure, then our new scheme is selectively CPA-secure.Theorem 9.
Assume that Basic CP-ABE scheme is selectively CPA-secure. Then our new scheme is selectively CPA-secure.Proof.
IfA breaks our new CP-ABE scheme at nonnegligible advantage, then we find an algorithm B which breaks Basic CP-ABE scheme at nonnegligible advantage. We assume that C is the challenger with respect to B for Basic CP-ABE. B interacts with A as demonstrated in the following steps.
Init. A sends B its challenge access policy A∗. B gives challenge access policy A∗ to C and obtains the public parameters PK=(e,g1,h,u,v,d,Y,{Ti,j}i∈[1,n],j∈[1,ni],H) for Basic CP-ABE.
Setup. B sends PK to A.
Query Phase 1. B maintains a table Tb and a set D which are initialized as empty. A adaptively launches queries.
(1) Private Key Query on Attribute Set S. B obtains the private key SKS by calling the key generation oracle of C with respect to S. Then, B lets D=D∪S and sends the private key SKS to A.
(2) Transformation Key Query on Attribute Set S. B scans the tuple (S,SKS,TKS,RKS) in table Tb. If such a tuple exists, it sends the transformation key TKS to A. Otherwise, B selects random exponents z,r∈Zp. B computes K1′=hz(g1∑vi,j∈Sti,j)r and K2′=g1r. B stores the tuple (S,∗,TKS=(S,K1′,K2′),z) in table Tb and returns TKS to A. Observe that B does not know the actual retrieving key RKS=y/z. Here, we compute as follows: (4)eC2,K1′eC3,K2′=eg1s,hzg1∑vi,j∈Sti,jre∏vi,j∈ATi,js,g1r=eg1,hszeg1,g1sr∑vi,j∈Sti,jeg1,g1sr∑vi,j∈Ati,j=eg1,hsz=T′,C1T′RKS=M·eg1,hyseg1,hsz·y/z=M.
Challenge. A submits messages M0,M1 with same length and challenge access policy A∗. B gives M0,M1 and A∗ to C to obtain the challenge ciphertext CT∗. B returns CT∗ to A as its challenge ciphertext.
Query Phase 2. A adaptively launches private key query as in phase 1, and B answers the queries as in phase 1.
Guess. A obtains μ′. B also obtains μ′.
If the guessμ′ for A of our scheme is correct, the guess of B for Basic CP-ABE scheme is correct too. So we can conclude that if A can attack our scheme at nonnegligible advantage, then we will find an algorithm B which attacks Basic CP-ABE scheme under the selective CPA security model at nonnegligible advantage.Theorem 10.
Our CP-ABE scheme is verifiable if the discrete logarithm assumption defined in Section2.2 holds.Proof.
Suppose that there exists an adversaryA that attacks verifiability of our new scheme at nonnegligible advantage. We find an algorithm B that can solve the DL problem at nonnegligible advantage.
Setup. B chooses x,y,m,l∈RZp, h∈RG1, and ti,j∈RZp(i∈[1,n],j∈[1,ni]). H:GT→Zp∗ is a secure hash function. PK=(e,g1,h,u=g1x,v=g1m,d=g1l,Y=e(g1,h)y,{Ti,j}i∈[1,n],j∈[1,ni],H) is the public parameter. The master secret key is MK=(y,{ti,j}i∈[1,n],j∈[1,ni]). B returns PK to A.
Query Phase 1. A adaptively launches transformation key, private key, decryption, and Decryptionout queries. As B knows MK, it can answer the queries properly.
Challenge. A gives M∗ and challenge access policy A∗ to B. B computes the ciphertext CT∗ of M∗ using the encryption algorithm in [33] and returns CT∗=(A∗,C^,C1,C2,C3,C1′,C2′,C3′) to A, where C^=uH(M∗)vH(M~∗)d and M~∗∈GT is chosen by B randomly.
Query Phase 2. A adaptively launches private key queries as in phase 1. B answers queries as in phase 1.
Output. A returns attribute set S∗ and transformed ciphertext CT∗′=(T^=C^,T1=C1,T1′=C1′,T′,T′′).
B computes T1/T′zS∗=M and T1′/T′′zS∗=M~, where zS∗ is the retrieving key for attribute set S∗. If A wins the above game, then B can obtain(5)g1xHM∗+mHM~∗+l=uHM∗vHM~∗d=C^=T^=uHMvHM~d=g1xHM+mHM~+l,where M≠M∗ and M∗,M~∗,M,M~,m,l are obtained by B. Because H is a collision-resistant hash function, H(M∗) is not equal to H(M) with overwhelming probability. Thus, B gets x=m(H(M~∗)-H(M~))/H(M)-H(M∗), which breaks the DL assumption. It is paradoxical, so our CP-ABE scheme is verifiable


## 5. Performance Comparison

PK, MK, SK, CT, TK, RK, and CT′ represent the length of public key, master key, private key, ciphertext, transform key, retrieving key, and transformed ciphertext without the access policy, respectively. Additionally, Encrypt, Decrypt, Transform, and Decryptout represent the computational costs of the algorithms’ encryption, decryption, transformation, and outsourcing decryption, respectively. G1, GT, and Zp denote the bit-length of the elements belonging to G1, GT, and Zp. kCe, kH, and kG1 denote the k-times computation in the pairing, hash function, and group G1, respectively. U={att1,…,attn} denote the attribute universe. N1 and N2 are the amounts of the attributes related to ciphertext and private key, respectively. N=∑i=1nni denotes the total number of possible attribute values.Tables1–3 show that our scheme is efficient. Table 1 illustrates that the size of private key, ciphertext, and transform key in our scheme is constant. However, the size of private key, ciphertext, and transform key in [11, 12, 31] depends upon the number of attributes. Therefore, our scheme greatly reduces the communication overhead and is very suitable for bandwidth limited devices. As the operation cost over Zp is much smaller than group and pairing operation, we ignore the computation time over Zp. Compared with the scheme in [11, 12, 31], the computational overhead for the decryption and transformation operations in our scheme is much smaller. From Table 2, we observe that the computational overhead over group and pairing in [11, 12, 31] depends on the number of attributes, while it is constant in our scheme. The computational overhead for the outsourcing decryption is constant in above schemes. Table 3 illustrates that only our scheme satisfies all properties.Table 1
Size of each value.
PK MK SK CT TK RK C T ′ LCL 13 [11] n + 4 G 1 Z p None N 1 + 2 G 1 + G T 2 N 2 G 1 2 G 1 2 G 1 + 2 G T LDG 13 [31] 5 + n G 1 + G T Z p ( 2 + N 2 ) | G 1 | 4 N 1 + 3 G 1 + 2 G T 2 + N 2 G 1 Z p G 1  + 4 | G T | GHW 11 [12] 2 G 1 + G T Z p None 2 N 1 + 1 G 1 + G T 2 + N 2 G 1 Z p 2 G T Our scheme ( N + 5 ) | G 1 | + | G T | ( N + 1 ) | Z p | 2 | G 1 | 5 | G 1 | + 2 | G T | 2 | G 1 | | Z p | | G 1 | + 4 | G T |Table 2
Computational times.
Encrypt Decrypt Transform D e c r y p t o u t LCL 13 [11] C e + 2 G T + ( 3 + 2 N 1 ) G 1 None 2 ( N 2 - 1 ) C e + 2 N 2 G T 2 C e + 3 G T LDG 13 [31] 2 H + ( 10 + 8 N 1 ) G 1 + 4 G T 4 ( N 2 - 1 ) C e + 4 N 2 G T ( 4 N 2 - 2 ) G T + ( 4 N 2 - 2 ) C e 4 G T GHW 11 [12] ( 4 N 1 + 1 ) G 1 + 3 G T + N 1 H None ( 3 N 2 - 1 ) G 1 + ( N 2 + 1 ) G T + ( N 2 + 2 ) C e 2 G T Our scheme 2 H + ( 2 N 1 + 6 ) G 1 + 4 G T 4 C e + 4 G T 4 C e + 2 G T 4 G TTable 3
Property of each scheme.
Outsourcing Verifiability Constant ciphertext length LCL 13 [11] Yes No No LDG 13 [31] Yes Yes No GHW 11 [12] Yes No No Our scheme Yes Yes YesIn order to evaluate the efficiency for our scheme, we implement our scheme with java pairing-based cryptography (JPBC) library [36], a port for the pairing-based cryptography (PBC) library in C [37]. The elliptic curve parameter we choose is type-A, and the order of group is 160 bits. We run our code on a PC with 64-bit 2.6-GHz Intel Core i5-3320M CPU, with 6 GB RAM, and mobile phone with 4-core 1.8 GHz Processor 2 G memory Android OS 4.4.2, respectively. We also implement the scheme [31] for comparison. Figure 2 compares the times of decryption algorithm spent in our scheme and Lai et al.’s scheme [31]. The result shows that our scheme is much more efficient than Lai et al.’s scheme [31] because the time spent in our scheme does not grow with the amount of attributes involved in the access policy. Figure 3 shows the time of the transformation algorithm in PC and mobile phone for two schemes. Similar to the decryption algorithm, the time required by transformation grows linearly with the number of attributes for Lai et al.’s scheme [31], while it is almost constant for our scheme. Figure 4 shows that the times of the outsourcing decryption algorithm in PC and mobile phone for two schemes are nearly same. Figure 5 shows the ciphertext length in our scheme and Lai et al.’s scheme [31]. We can find that the ciphertext length in our scheme is constant, while it will grow with the amount of attributes involved in access policy linearly. So we can conclude that our scheme greatly reduces the communication overhead and is very suitable for bandwidth limited devices. Figure 6 illustrates that the length of partially decrypted ciphertext in two schemes is almost same.Figure 2
Decryption time.Figure 3
Transformation time.Figure 4
Outsourcing decryption time.Figure 5
Ciphertext length.Figure 6
Partial decryption ciphertext length.


## 6. Conclusions

In this article, we propose a new verifiable outsourced CP-ABE scheme with constant ciphertext length and, moreover, we prove that our scheme is secure and verifiable in standard model. Security in our scheme is reduced to that of scheme in [33] and verifiability is reduced to DL assumption. The computational overhead for the decryption and transformation operations in our scheme is constant, which does not rely on the amount of attributes. In addition, we outsource the expensive operation to the cloud service provider and leave the slight operations to be done on user’s device. Therefore, our scheme is very efficient. What is more, the ciphertext length in our scheme does not grow with the number of attributes, which reduces the communication cost greatly. The proposed scheme has the potential application in various lower power devices with limited computational power, such as mobile phone.



---

*Source: 3596205-2017-01-10.xml*