# Two-Party Attribute-Based Key Agreement Protocol with Constant-Size Ciphertext and Key

Authors: Jiguo Li; Shengzhou Hu; Yichen Zhang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Based on mutual authentication, the session key is established for communication nodes on the open network. In order to satisfy fine-grained access control for cloud storage, the two-party attribute-based key agreement protocol (TP-AB-KA) was proposed. However, the existing TP-AB-KA protocol is high in the cost of computation and communication and is not unfit for application in a mobile cloud setting because mobile devices are generally resource constrained. To solve the above issue, we propose a TP-AB-KA protocol with constant-size ciphertext and key. Our TP-AB-KA protocol is provable security in the standard model. The concrete proof is given under the augmented multisequence of exponents' decisional Diffie-Hellman (aMSE-DDH) hypothesis in the attribute-based BJM model (AB-BJM). Compared with the existing TP-AB-KA protocols, the computation cost and communication cost of our protocol are largely reduced.


---

## Body

## 1. Introduction

Key agreement (KA) protocol is an important component in cryptography. By establishing a session key, KA protocol provides security services of confidentiality, integrity, and availability for open communication on the network node. Recently, the two-party attribute-based key agreement protocol (TP-AB-KA) was first proposed in [1]. In TP-AB-KA protocol, the attribute-based encryption (ABE) was adopted for exchanging secret messages from two participants. This kind of protocol carries out negotiating session key based on the mutual authentication of participants’ attribute information. Sahai and Waters [2] first proposed ABE, which was used for fine-grained access control for cloud storage. User identity is determined by his/her attributes. ABE is often applied in a one-to-many encryption situation, where data encrypted with certain attributes policy is correctly decrypted by any users whose attributes satisfy that access structure. TP-AB-KA protocol inherits the advantages of ABE schemes, such as using attributes to describe one user and realize the protection of user’s identity. This also enables the TP-AB-KA protocols to meet the needs of some specific application scenarios where participants’ attributes act as critical factor for mutual authentication.For example, in an electronic project review system, a reviewer wants to make inquiries for some bidders. Suppose there aren attribute characters in this scene. The role information is described with certain attribute sequence <…,∗i,∗i+1,…>, which includes n elements in total. The subscripts i,i+1 stand for the corresponding locations in the sequence, where we use i location to denote “reviewer” role and i+1 location to denote “bidder” role. If a role U1 is a reviewer, its attribute sequence is instantiated with <…,0i,1i+1,…>, where “0” shows “having” certain attribute character and “1” shows “not having”. So <…,0i,1i+1,…> shows that U1 is a reviewer and not a bidder. U1 obtains the corresponding private key generated by the trusted authority (TA) according to U1’s attribute sequence. In the same way, the authentication policy based on attributes is also described in such way. For instance, there are some qualifications about bidders, such as “A: more than 2 grade enterprise qualification”, “B: more than 10 years warranty”, etc. Those qualifications are written into a sequence form, that is, <…,∗j,∗j+1,…>(j≠i). j,j+1 locations stand for A and B qualifications, respectively. If U1 wants to talk with a bidder with A and B qualifications, U1 gives out the corresponding authentication policy ABidder¯¯=<…,0j,0j+1,…>. Two “0” show having A and B qualifications together.Based on above attribute description, the inquiry procedure of electronic review system is done as follows: Before voting, the reviewers need to ask some inquiry for some related bidders without revealing their real identities. Suppose that a reviewerU1 with attribute sequence <…,0i,1i+1,…> wants to inquire for bidders, such as U2 with “A: more than 2 grade enterprise qualification” and “B: more than 10 years warranty” qualifications. If U2 satisfies ABidder¯¯ and U1 satisfies AReview¯¯=<…,0i,1i+1,…> specified by U2, then U1 can consult a session key with U2 to achieve secure communication by using a TP-AB-KA protocol.With the increasing popularity and application of mobile devices, more and more applications are migrated from PCs to mobile devices, such as smart phones. Above example also happens in mobile environment. Since most mobile devices are resource constrained, it is more important to improve the performance of TP-AB-KA protocol by reducing computation cost and communication cost. However, the existing TP-AB-KA protocols are not so good in performance because the length of ciphertext and key grows linearly with the number of related attributes.


### 1.1. Our Motivation and Contribution

ABE scheme has fine-grained data access control, which can be well applied to many scenes where KA protocols are used. As shown in above example, ABE scheme was adopted for attribute authentication between the participants in the protocol and did not reveal their identities. More and more KA protocols introduce ABE schemes to construct TP-AB-KA protocols. However, the length of key and ciphertext in those TP-AB-KA protocols grows linearly with the number of attributes which participants own or are embedded in access policies. Obviously, those TP-AB-KA protocols are unfit for the lightweight applications. For example, mobile devices have become the primary devices in open cloud setting, which are resource constrained and require the protocols with high performance. In order to solve above problem, we first propose a two-party attribute-based key agreement protocol with constant-size ciphertext and key based on the CP-ABE scheme [3].Our protocol adopts an AND-gate access structure based on the whole attribute universe. A polynomial functionf⃑(x,·) embedded in the exponent location of a group element is defined to express the attribute character of one participant. One factor x+H1(i) in f⃑(x,·) is one secret value, which reflects the ith attribute of the participant, where H1(·) is a hash function. The polynomial function f⃑(x,·)=∏i∉Ω(x+H1(i)) is used to describe all attributes of the participant, where Ω is the index set of the corresponding items in attribute sequence. Similarly, one data access policy is also described with polynomial function. When x in f⃑(x,·) is substituted with the master key of the trusted authority (ΤΑ), the polynomial functions f⃑(x,·) is computed into a constant-size value, based on which both the key and the ciphertext in our protocol can be calculated into some values, respectively, which are irrelevant to the number of corresponding attributes. By using this method, we can generate the constant-size key and ciphertext.The proposed protocol is proved secure in AB-BJM model [4] based on the difficult problem of the augmented multisequence of exponents decisional Diffie-Hellman (aMSE-DDH) hypothesis [5] in standard model. The public key parameters and specific oracle queries Send~(·),Corrupt~(·),Reveal~(·) are simulated successfully. The challenge task of aMSE-DDH hypothesis is embedded in the communication ciphertexts. Compared with the existed TP-AB-KA protocols, our protocol’s computation and communication costs are largely reduced. The constant-size key and chipertext improve the implementation efficiency and make our protocol be more suitable for the application of lightweight level.


### 1.2. Organization

The related work is introduced in Section2. The preliminaries are introduced in Section 3. In Section 4, a TP-AB-KA protocol is proposed. TP-AB-KA protocol is proved to be secure in Section 5. Subsequently, we give the performance comparison between the protocol [4] and our protocol in Section 6. We conclude our paper in Section 7.


## 1.1. Our Motivation and Contribution

ABE scheme has fine-grained data access control, which can be well applied to many scenes where KA protocols are used. As shown in above example, ABE scheme was adopted for attribute authentication between the participants in the protocol and did not reveal their identities. More and more KA protocols introduce ABE schemes to construct TP-AB-KA protocols. However, the length of key and ciphertext in those TP-AB-KA protocols grows linearly with the number of attributes which participants own or are embedded in access policies. Obviously, those TP-AB-KA protocols are unfit for the lightweight applications. For example, mobile devices have become the primary devices in open cloud setting, which are resource constrained and require the protocols with high performance. In order to solve above problem, we first propose a two-party attribute-based key agreement protocol with constant-size ciphertext and key based on the CP-ABE scheme [3].Our protocol adopts an AND-gate access structure based on the whole attribute universe. A polynomial functionf⃑(x,·) embedded in the exponent location of a group element is defined to express the attribute character of one participant. One factor x+H1(i) in f⃑(x,·) is one secret value, which reflects the ith attribute of the participant, where H1(·) is a hash function. The polynomial function f⃑(x,·)=∏i∉Ω(x+H1(i)) is used to describe all attributes of the participant, where Ω is the index set of the corresponding items in attribute sequence. Similarly, one data access policy is also described with polynomial function. When x in f⃑(x,·) is substituted with the master key of the trusted authority (ΤΑ), the polynomial functions f⃑(x,·) is computed into a constant-size value, based on which both the key and the ciphertext in our protocol can be calculated into some values, respectively, which are irrelevant to the number of corresponding attributes. By using this method, we can generate the constant-size key and ciphertext.The proposed protocol is proved secure in AB-BJM model [4] based on the difficult problem of the augmented multisequence of exponents decisional Diffie-Hellman (aMSE-DDH) hypothesis [5] in standard model. The public key parameters and specific oracle queries Send~(·),Corrupt~(·),Reveal~(·) are simulated successfully. The challenge task of aMSE-DDH hypothesis is embedded in the communication ciphertexts. Compared with the existed TP-AB-KA protocols, our protocol’s computation and communication costs are largely reduced. The constant-size key and chipertext improve the implementation efficiency and make our protocol be more suitable for the application of lightweight level.


## 1.2. Organization

The related work is introduced in Section2. The preliminaries are introduced in Section 3. In Section 4, a TP-AB-KA protocol is proposed. TP-AB-KA protocol is proved to be secure in Section 5. Subsequently, we give the performance comparison between the protocol [4] and our protocol in Section 6. We conclude our paper in Section 7.


## 2. Related Work

The key agreement (KA) protocol is used to establish secure communication between two or more parties and authenticate entities in an open environment. With the emerging of identity-based cryptography, Smart [6] presented the first two-party identity-based key agreement protocol (ID-KA) which adopted the IBE scheme [7]. Since then, lots of ID-KA protocols have successively been put forward [1, 8–11]. Those ID-KA protocols were proved security in various models, respectively, such as the BJM model [12], the BR4 model, the CK model, etc. Huang and Cao [13] provided the first ID-AK protocol which was provable security in eCK [14] model. Based on the BJM model [12], Chenet al. [9] proposed the ID-BJM model and constructed identity-based key agreement protocols. In order to implement fine-grained access control, session keys are negotiated based on mutual authentication of participants’ attribute information. many attribute-based key agreement (AB-KA) protocols [15–20] are presented. In AB-KA protocols, attribute-based encryption (ABE) plays important role in protecting secret messages used to generate session keys. ABE [21] was mainly divided into two categories called ciphertext-policy ABE (CP-ABE) and key-policy ABE (KP-ABE). In CP-ABE, data owner chooses an access structure on attributes and encrypts data with the corresponding attribute public key. Access structure is embedded in the ciphertext, while the secret key is produced according to the attribute set of data user. If the attributes held by a user satisfy access structure embedded in the ciphertext, then he/she decrypts such ciphertext [22]. KP-ABE scheme is inverse. The encryptor selects the descriptive attributes to encrypt data. Recently, Liet al. [23, 24] presented two CP-ABE schemes with efficient attribute revocation, which resists the user collusion attack and supports fine-grained access control. There are some privacy-preserving decentralized CP-ABE [25–27] schemes, in which the size of the ciphertext grows linearly with the number of attributes embedded in access policy. In order to improve efficiency, Emuraet al. [28] presented a CP-ABE scheme with constant ciphertext size. Many ABE schemes [29–38] were presented in various application domains, such as ABE with outsourced data decryption [29, 30, 37], ABE with efficient attribute revocation [31], ABE with full verifiability [30], ABE with keyword search function [29, 31], traceable ABE [32, 33], ABE with leakage resilience [34–36], auditable ABE [38], etc. In order to solve key escrow problem, Liet al. [39, 40] presented two certificate-based encryption schemes with leakage resilience. ABE schemes have wide application in cloud storage [41, 42], mobile social networks [43] and smart grid [44]. The original AB-AK protocol [1] gave a secret handshake mechanism based on attributes. Later, lots of AB-KA protocols [15–20] were presented. Wanget al. [18] presented a variant of AB-KA protocol based on ABE scheme. But this protocol did not realize mutual authentication on the basis of participants’ attributes. Yoneyama [20] put forward two rounds of AB-KA protocol by using a design technique of the NAXOS protocol and gave the security proof in the modified eCK model. Recently, Weiet al. [4] proposed an AB-KA protocol which is proved secure in the modified BJM model under the decisional bilinear Diffie-Hellman assumption in the standard model. But the length of communication messages and decryption key in [4] increased linearly with the number of attributes and was unsuitable for the resource constrained application.


## 3. Preliminaries

### 3.1. Access Structure

Suppose thatATT={att1,att2,…,attn} includes n attributes in our system. An access structure is a nonempty subset A⊆2{att1,att2,…,attn}∖{⌀}. In particular, for a collection A is monotone if B︹∈A and B︹⊆C︹, then C︹∈A ∀B︹,C︹. If a user with a set in A then he/she is authorized to access some resources.


### 3.2. Bilinear Maps

G, GT are two multiplicative cyclic groups with prime order p. g is the generator of G and e is bilinear map e:G×G→GT. The bilinear map e satisfies the following properties:(1)
Bilinearity: for allι,κ∈Zp, e(gι,gκ)=e(g,g)ικ.(2)
Nondegeneracy:e(g,g)≠1.(3)
Computability: there is an efficient algorithm to computee(ϕ,ζ) for ∀ϕ,ζ∈G.


### 3.3. aMSE-DDH Assumption [5]

The aMSE-DDH assumption is defined as follows. LetΓ={G1,G2,GT,p,e} be the pairing group, and let f→(x),ϑ→(x) be polynomials with coprimes. Let ς0,ħ0 be the generators of G1,G2, respectively. β is a random element of Zp and R is selected randomly in GT. Given a tuple Y→=<ς0,ς0β,ς0β2,…,ς0βn-1,ς0βf→(β);ħ0,ħ0β,ħ0β2,…,ħ0βn;ħ01/ϑ→(β), ħ0β/ϑ→(β),ħ0β2/ϑ→(β),…,ħ0βn/ϑ→(β);ς0ξβf→(β),ħ0ξ,R>, if no probabilistic polynomial time adversary A makes a distinction between e(ς0,ħ0)f→(β)ξ and R, then we claim that the aMSE-DDH assumption holds with the advantage advA=|Pr[A(Y→,e(ς0,ħ0)f→(β)ξ)=1]-Pr[A(Y→,R)=1]|≤ε, where ε is a negligible function.


### 3.4. Outline of Our TP-AB-KA Protocol

We give a two-party attribute-based key agreement (TP-AB-KA) protocol. There are 3 roles, trusted authority (ΤΑ) and two participants (initiator Ini and responder Res). ΤΑ is a trusted role who monitors the participants’ attributes and issue private keys for them. Two participants, Ini and Res, make key agreement as Figure 1.Figure 1
System model of our TP-AB-KA protocol.S y s t e m S e t u p ( λ ) → M S K , M P K. This algorithm takes as input a security parameter λ and outputs master secret key MSK and public parameters MPK.K e y G e n e r a t i o n ( I n i ¯ ¯ ) → S K 1. This algorithm is implemented by trusted authority (ΤΑ). It takes as input attribute sequence Ini¯¯ of a participant Ini and outputs Ini’s private key SK1. Similarly, for another participant Res with the attribute sequence Res¯¯, ΤΑ outputs his/her private key SK2 by calling KeyGeneration algorithm.E n c r y t i o n ( A R e s ¯ ¯ ≥ ¯ ¯ , M I n i ) → C T I n i ⇌ R e s. This algorithm takes as input the plaintext MIni and the data access policy ARes¯¯≥¯¯, which is proposed by Ini and the attributes of the participant Res can satisfy. This algorithm outputs the ciphertext CTIni⇌Res according to ARes¯¯≥¯¯. Similarly, Res selects data access policy AIni¯¯≥¯¯ of which Ini’s attributes can satisfy and encrypts plaintext MRes into the ciphertext CTRes⇌Ini according to AIni¯¯≥¯¯ by calling this algorithm.D e c r y t i o n ( C T I n i ⇌ R e s , S K 1 ) → M I n i. This algorithm takes as input the ciphertext CTIni⇌Res and Ini’s private key SK1 and outputs the message MIni. By calling this algorithm, Res decrypts CTRes⇌Ini into MRes by using the private key SK2.S e s s K e y G e n e r a t i o n ( C T I n i ⇌ R e s , C T R e s ⇌ I n i ) → K I n i ≫ R e s , K R e s ≫ I n i. This is an interactive procedure. Firstly, Ini sends CTIni⇌Res to Res and Res sends CTRes⇌Ini to Ini, respectively. Secondly, Ini decrypts CTRes⇌Ini and Res decrypts CTIni⇌Res by using Decrytion algorithm, respectively. Thirdly, Ini and Res compute the session key KIni≫Res and KRes≫Ini, respectively, where KIni≫Res=KRes≫Ini.


### 3.5. AB-BJM Model [4]

We employ the attribute-based BJM model to prove the security of our TP-AB-KA protocol. There are many protocol participants, which are all formalized as oracles. An attackerA~ can access those oracles by issuing some specified queries: Send~(·),Corrupt~(·),Reveal~(·). An oracle ΠU1,U2k represents the k-th instance of a participant U1 involved with another participant U2 in a session. U1, U2 have the corresponding attribute sequences and the private keys, respectively. Some key messages in AB-KA protocol are encrypted or decrypted based on a certain kind of ABE scheme.The security of the protocol∏ is described via a game with two phases.(1) The First Phase. A~ is allowed to launch the below queries in any order.S e n d ~ ( Π U 1 , U 2 k , m ). A~ initiates a session or sends messages to the participants. On receiving the message m, oracle ΠU1,U2k implements the protocol and responds with an outgoing message m^, or a decision to indicate accepting or rejecting the session. If ΠU1,U2k does not exit, it is created as an initiator if m=λ(the security parameter), or as a responder otherwise.C o r r u p t ~ ( U ). The participant U responds with its private key.R e v eal ~ ( Π U 1 , U 2 k ). If the oracle accepts, it reveals the session key; otherwise, it returns⊥.(2) The Second Phase. Once A~ finishes the first phase works, it begins the second phase by selecting a fresh oracle ΠU1,U2k and launching the Test~(ΠU1,U2k) query. The fresh oracle ΠU1,U2k and Test~(·) query are defined as below.Definition 1 (fresh oracle).
An oracleΠU1,U2k is fresh if (1) ΠU1,U2k has been accepted; (2) ΠU1,U2k is not opened (not being submitted the Reveal~(·) query); (3) U1,U2 is not corrupted (not being submitted the Corrupt~(·) query); (4) There is no opened oracle ΠU2,U1j, which has matched a conversation to ΠU1,U2k.
T e s t ~ ( Π U 1 , U 2 k ). If ΠU1,U2k is fresh, B~ randomly chooses τ∈{0,1}. It responds with the session key if τ=0, otherwise, a random sample from the distribution of the session keys.
A ~ continues to query the oracles except that it does not reveal the test oracle ΠU1,U2k or its session participant ΠU2,U1j (if it exists), and it does not corrupt the participant U2.
At last the adversary outputs a guessτ′ for τ. If τ=τ′, we claim that the adversary wins. The advantage of the adversary is defined as AdvA~(k)=max{0,PrA~wins-1/2}.A secure key agreement protocol∏ is defined as below.Definition 2.
Protocol∏ is a secure key agreement protocol if (1) the adversary faithfully conveys messages. Both ΠU1,U2k and ΠU2,U1j are always accepted and hold the same session key which is distributed uniformly on {0,1}k; (2) AdvA~(k) is negligible.


## 3.1. Access Structure

Suppose thatATT={att1,att2,…,attn} includes n attributes in our system. An access structure is a nonempty subset A⊆2{att1,att2,…,attn}∖{⌀}. In particular, for a collection A is monotone if B︹∈A and B︹⊆C︹, then C︹∈A ∀B︹,C︹. If a user with a set in A then he/she is authorized to access some resources.


## 3.2. Bilinear Maps

G, GT are two multiplicative cyclic groups with prime order p. g is the generator of G and e is bilinear map e:G×G→GT. The bilinear map e satisfies the following properties:(1)
Bilinearity: for allι,κ∈Zp, e(gι,gκ)=e(g,g)ικ.(2)
Nondegeneracy:e(g,g)≠1.(3)
Computability: there is an efficient algorithm to computee(ϕ,ζ) for ∀ϕ,ζ∈G.


## 3.3. aMSE-DDH Assumption [5]

The aMSE-DDH assumption is defined as follows. LetΓ={G1,G2,GT,p,e} be the pairing group, and let f→(x),ϑ→(x) be polynomials with coprimes. Let ς0,ħ0 be the generators of G1,G2, respectively. β is a random element of Zp and R is selected randomly in GT. Given a tuple Y→=<ς0,ς0β,ς0β2,…,ς0βn-1,ς0βf→(β);ħ0,ħ0β,ħ0β2,…,ħ0βn;ħ01/ϑ→(β), ħ0β/ϑ→(β),ħ0β2/ϑ→(β),…,ħ0βn/ϑ→(β);ς0ξβf→(β),ħ0ξ,R>, if no probabilistic polynomial time adversary A makes a distinction between e(ς0,ħ0)f→(β)ξ and R, then we claim that the aMSE-DDH assumption holds with the advantage advA=|Pr[A(Y→,e(ς0,ħ0)f→(β)ξ)=1]-Pr[A(Y→,R)=1]|≤ε, where ε is a negligible function.


## 3.4. Outline of Our TP-AB-KA Protocol

We give a two-party attribute-based key agreement (TP-AB-KA) protocol. There are 3 roles, trusted authority (ΤΑ) and two participants (initiator Ini and responder Res). ΤΑ is a trusted role who monitors the participants’ attributes and issue private keys for them. Two participants, Ini and Res, make key agreement as Figure 1.Figure 1
System model of our TP-AB-KA protocol.S y s t e m S e t u p ( λ ) → M S K , M P K. This algorithm takes as input a security parameter λ and outputs master secret key MSK and public parameters MPK.K e y G e n e r a t i o n ( I n i ¯ ¯ ) → S K 1. This algorithm is implemented by trusted authority (ΤΑ). It takes as input attribute sequence Ini¯¯ of a participant Ini and outputs Ini’s private key SK1. Similarly, for another participant Res with the attribute sequence Res¯¯, ΤΑ outputs his/her private key SK2 by calling KeyGeneration algorithm.E n c r y t i o n ( A R e s ¯ ¯ ≥ ¯ ¯ , M I n i ) → C T I n i ⇌ R e s. This algorithm takes as input the plaintext MIni and the data access policy ARes¯¯≥¯¯, which is proposed by Ini and the attributes of the participant Res can satisfy. This algorithm outputs the ciphertext CTIni⇌Res according to ARes¯¯≥¯¯. Similarly, Res selects data access policy AIni¯¯≥¯¯ of which Ini’s attributes can satisfy and encrypts plaintext MRes into the ciphertext CTRes⇌Ini according to AIni¯¯≥¯¯ by calling this algorithm.D e c r y t i o n ( C T I n i ⇌ R e s , S K 1 ) → M I n i. This algorithm takes as input the ciphertext CTIni⇌Res and Ini’s private key SK1 and outputs the message MIni. By calling this algorithm, Res decrypts CTRes⇌Ini into MRes by using the private key SK2.S e s s K e y G e n e r a t i o n ( C T I n i ⇌ R e s , C T R e s ⇌ I n i ) → K I n i ≫ R e s , K R e s ≫ I n i. This is an interactive procedure. Firstly, Ini sends CTIni⇌Res to Res and Res sends CTRes⇌Ini to Ini, respectively. Secondly, Ini decrypts CTRes⇌Ini and Res decrypts CTIni⇌Res by using Decrytion algorithm, respectively. Thirdly, Ini and Res compute the session key KIni≫Res and KRes≫Ini, respectively, where KIni≫Res=KRes≫Ini.


## 3.5. AB-BJM Model [4]

We employ the attribute-based BJM model to prove the security of our TP-AB-KA protocol. There are many protocol participants, which are all formalized as oracles. An attackerA~ can access those oracles by issuing some specified queries: Send~(·),Corrupt~(·),Reveal~(·). An oracle ΠU1,U2k represents the k-th instance of a participant U1 involved with another participant U2 in a session. U1, U2 have the corresponding attribute sequences and the private keys, respectively. Some key messages in AB-KA protocol are encrypted or decrypted based on a certain kind of ABE scheme.The security of the protocol∏ is described via a game with two phases.(1) The First Phase. A~ is allowed to launch the below queries in any order.S e n d ~ ( Π U 1 , U 2 k , m ). A~ initiates a session or sends messages to the participants. On receiving the message m, oracle ΠU1,U2k implements the protocol and responds with an outgoing message m^, or a decision to indicate accepting or rejecting the session. If ΠU1,U2k does not exit, it is created as an initiator if m=λ(the security parameter), or as a responder otherwise.C o r r u p t ~ ( U ). The participant U responds with its private key.R e v eal ~ ( Π U 1 , U 2 k ). If the oracle accepts, it reveals the session key; otherwise, it returns⊥.(2) The Second Phase. Once A~ finishes the first phase works, it begins the second phase by selecting a fresh oracle ΠU1,U2k and launching the Test~(ΠU1,U2k) query. The fresh oracle ΠU1,U2k and Test~(·) query are defined as below.Definition 1 (fresh oracle).
An oracleΠU1,U2k is fresh if (1) ΠU1,U2k has been accepted; (2) ΠU1,U2k is not opened (not being submitted the Reveal~(·) query); (3) U1,U2 is not corrupted (not being submitted the Corrupt~(·) query); (4) There is no opened oracle ΠU2,U1j, which has matched a conversation to ΠU1,U2k.
T e s t ~ ( Π U 1 , U 2 k ). If ΠU1,U2k is fresh, B~ randomly chooses τ∈{0,1}. It responds with the session key if τ=0, otherwise, a random sample from the distribution of the session keys.
A ~ continues to query the oracles except that it does not reveal the test oracle ΠU1,U2k or its session participant ΠU2,U1j (if it exists), and it does not corrupt the participant U2.
At last the adversary outputs a guessτ′ for τ. If τ=τ′, we claim that the adversary wins. The advantage of the adversary is defined as AdvA~(k)=max{0,PrA~wins-1/2}.A secure key agreement protocol∏ is defined as below.Definition 2.
Protocol∏ is a secure key agreement protocol if (1) the adversary faithfully conveys messages. Both ΠU1,U2k and ΠU2,U1j are always accepted and hold the same session key which is distributed uniformly on {0,1}k; (2) AdvA~(k) is negligible.


## 4. TP-AB-KA Protocol

A TP-AB-KA protocol with constant-size key and ciphertext is first given in this paper. We embed the ABE scheme [3] into the key agreement protocol. Two parties in our protocol make agreement of the session key based on the exchanged secret messages. Suppose that two participants U1,U2 encrypt their own secret messages into the ciphertexts according to the access policies proposed by each other, respectively. U1 acts as an initiator and U2 acts as a responder. So long as the attributes of U1, U2 satisfy mutual access policies, they can obtain the partner's secret messages, respectively. U1, U2 use the corresponding secret messages to calculate the same session key. The protocol is showed in Figure 2. Our TP-AB-KA protocol includes three stages: SystemSetup, KeyGeneration and KeyExchange. The concrete construction is described as below.Figure 2
TP-AB-KA protocol.S y s t e m S e t u p. Suppose that λ is the security parameter. Let G and GT be multiplicative cyclic groups with prime order p. A trusted authority (ΤΑ) selects generators g, h from G and keeps g secret. Suppose that there is an attribute universe ⟦U⟧=<att1,att2,…,attn> including n attributes. For each attribute atti, ΤΑ randomly selects β,σ1,σ2∈Zp and calculates Hi~=hβi, Qi~=hσ1βi, Ei~=hσ2βi, i∈{0,1,…,n}. ΤΑ keeps MSK={g,β,σ1,σ2} secret. This algorithm chooses 3 cryptographic hash functions: H1:{0,1}∗→Zp, H2:{0,1}∗→Zp, H3:GT→G. For the attribute sequence U¯¯=<z1,z2,…,zn> of one participant U, we define a polynomial function f⃑(x,U¯¯)=∏i=1n(x+H1(i))1-zi to describe U’s attribute character. Here, “zi=0” denotes “having the ith attribute value” and “zi=1” denotes “not having the ith attribute value”. We use AU¯¯≥¯¯=<z1′,z1′,…,zn′> to denote the attribute sequence which the attributes of U can satisfy. Any participant can compute a polynomial function f⃑(x,AU¯¯≥¯¯)=∏i=1n(x+H1(i))1-zi′ to describe a kind of data access policy. Here, zi′ has the same definition as zi. The algorithm finally outputs the public parameters MPK={e(g,h),gβ,Hi~,Qi~,Ei~,H1,H2,H3}.K e y G e n e r a t i o n. For a participant U1 with attribute sequence U1¯¯=<a1,a2,a3,…,an>, ΤΑ calculates f⃑(β,U1¯¯)=∏i=1n(β+H1(i))1-ai, which is a polynomial formula with n-degree at most. ΤΑ randomly selects tU1∈Zp and computes tU1′=1/σ1(1/f⃑(β,U1¯¯)-σ2tU1). ΤΑ computes U1’s private key SK1={gtU1,gtU1′}.For another participantU2 with U2¯¯=<b1,b2,b3,…,bn>, ΤΑ randomly selects tU2∈Zp and computes tU2′=1/σ1(1/f⃑(β,U2¯¯)-σ2tU2) by using the similar approach. ΤΑ computes U2’s private key SK2={gtU2,gtU2′}.E n c r y t i o n. U1 chooses a data access policy AU2¯¯≥¯¯=<b1′,b2′,b3′,…,bn′> which U2’s attributes can satisfy. U1 generates the corresponding f⃑(x,AU¯¯2≥¯¯)=∏i=1n(x+H1(i))1-bi′. Let ci^ be the coefficient of xi in f⃑(x,AU2¯¯≥¯¯). U1 randomly selects δm1∈{0,1}∗ and computes ιm1=H2(AU2¯¯≥¯¯,δm1), e(g,h)ιm1, Rm1=gβιm1, σ1,m1=(∏i=0n(Qi~)ci^)ιm1=hσ1f⃑(x,AU2¯¯≥¯¯)ιm1, σ2,m1=(∏i=0n(Ei~)ci^)ιm1=hσ2f⃑(x,AU2¯¯≥¯¯)ιm1. U1 generates CTU1⇌U2={AU2¯¯≥¯¯,Rm1,σ1,m1,σ2,m1}. Similarly, U2 completes the following work successively by using the same way. U2 chooses a data access policy AU1¯¯≥¯¯=<a1′,a2′,a3′,…,an′> which U2’s attributes can satisfy. U2 generates the corresponding f⃑(x,AU1¯¯≥¯¯)=∏i=1n(x+H1(i))1-ai′. Let di^ be the coefficient of xi in f⃑(x,AU1¯¯≥¯¯). Then U2 randomly selects δm2∈{0,1}l and computes ιm2=H2(AU1¯¯≥¯¯,δm2), e(g,h)ιm2, Rm2=gβιm2, σ1,m2=(∏i=0n(Qi~)di^)ιm2=hσ1f⃑(x,AU1¯¯≥¯¯)ιm2 and σ2,m2=(∏i=0n(Ei~)di^)ιm2=hσ2f⃑(x,AU1¯¯≥¯¯)ιm2. U2 generates CTU2⇌U1={AU1¯¯≥¯¯,Rm2,σ1,m2,σ2,m2}.D e c r y t i o n. Assume that U1 has the attribute sequence U1¯¯ and the corresponding private key SK1, U2 with U2¯¯ has SK2. U1 generates the share secret by using the following calculation steps after receiving CTU2⇌U1. For U1¯¯=<a1,a2,a3,…,an> and AU1¯¯≥¯¯=<a1′,a2′,a3′,…,an′>, U1 computes Δi=ai′-ai, i∈{0,1,⋯,n} and F⃑(x)=FAU⃑(x,AU1¯¯≥¯¯,U1¯¯)=∏i=1n(x+H1(i))Δi. U1¯¯ satisfies AU1¯¯≥¯¯, F⃑(x) is the (n-|U1¯¯|)-degree at most polynomial function, where F⃑i the coefficient of xi and F⃑0≠0. U1 computes W0~=e(Rm2,∏i=1nHi~c^i)=e(gβιm2,∏i=1nhβi-1ci︹)=e(g,h)βιm2∑i=1n|βi-1ci︹=e(g,h)ιm2(F→(β)-c0⌢)=e(g,h)ιm2(F→(β)-F→(0)), W1~=e(gtU1′,σ1,m2)=e(g,h)σ1f⃑(β,AU1¯¯≥¯¯)ιm2tU1′, W2~=e(gtU1,σ2,m2)=e(g,h)σ2f⃑(β,AU1¯¯≥¯¯)ιm2tU1, W~1·W2~=e(g,h)f⃑(β,AU1¯¯≥¯¯)ιm2(σ1tU1′+σ2tU1)=e(g,h)ιm2F→(β), (W~1·W2~/W0~)1/c0^=e(g,h)ιm2. At last, U1 obtains secret H3(e(g,h)ιm2). By using the similar approach, U2 computes Δi′=bi′-bi and F′⃑(x)=FAU⃑(x,AU2¯¯≥¯¯,U2¯¯)=∏i=1n(x+H1(i))Δi′. F′⃑(x) is the (n-|U2¯¯|)-degree at most polynomial function, where Fi′⃑ is denoted by the coefficient of xi and F0′⃑≠0. U2 obtains H3(e(g,h)ιm1) from the received ciphertext CTU1⇌U2.S e s s K e y G e n e r a t i o n. Firstly, U1 sends CTU1⇌U2 to U2 and U2 sends CTU2⇌U1 to U1, respectively. Secondly, U1, U2 decrypt CTU2⇌U1, CTU1⇌U2 by calling Decrytion algorithms, respectively. Thirdly, U1 and U2 compute the session key KU1≫U2=H3(e(g,h)ιm1)·H3(e(g,h)ιm2) and KU2≫U1=H3(e(g,h)ιm2)·H3(e(g,h)ιm1), respectively.


## 5. Security Analysis

Theorem 3.
Provided that the augmented multisequence of exponents decisional Diffie-Hellman (aMSE-DDH) [5] assumption holds, our protocol TP-AB-KA protocol is secure in the AB-BJM model. In detail, if there is an adversary A~ who attacks our protocol successfully at the advantage ε under the condition involving NU participants and QS sessions, a simulator B~ can be constructed to solve the aMSE-DDH problem at the advantage ε/(NU2·QS).Proof.
Suppose an adversaryA~ involves NU participants in the protocol and establishes QS sessions. B~ chooses k∗∈(0,QS) and two participants U1,U2 arbitrarily. B~ guesses that A~ launches the Test~(·) query to the participant ΠU1,U2k∗. A~ provides the access policies AU1,U2∗¯¯~={AU2¯¯≥∗¯¯,AU1¯¯≥∗¯¯}. Let AU2¯¯≥∗¯¯=AU2¯¯≥¯¯=<b1′,b2′,b3′…bn′> where bi′=0 denotes “having the ith attribute value” and bi′=1 denotes “not having the ith attribute value”. B~ sets ϑ^(x)=f⃑(x,AU2¯¯≥∗¯¯)=∏i=1n(x+H1(i))1-bi′, f^(x)=∏i=1n(x+H1(i))bi′. Here, f^(x) is |AU2¯¯≥¯¯|-degree polynomial and ϑ^(x) is (n-|AU2¯¯≥¯¯|)-degree polynomial. Let ci︹ be the coefficient of xi in f^(x). |AU2¯¯| denotes the number of nonzero items in AU2¯¯. R is randomly selected in GT. Let Y→=<ς0,ς0β,ς0β2,…,ς0βn-1,ς0βf^(β);ħ0,ħ0β,ħ0β2,…,ħ0βn;ħ01/ϑ^(β),ħ0β/ϑ^(β), ħ0β2/ϑ^(β),…,ħ0βn/ϑ^(β);ς0ξβf^(β),ħ0ξ,R>. B~ receives the challenge (e,p,G,GT,Y→,e(ς0,ħ0)f^(β)ξ,R,f^(x),ϑ^(x),AU1,U2∗¯¯~) and the task of B~ is to differentiate e(ς0,ħ0)f^(β)ξ from R.
S y s t e m S e t u p. B~ implicitly sets β as the master key which is used in the aMSE-DDH challenge instance. B~ simulates the public parameters as below. B~ randomly chooses ϖ1,ϖ2∈Zp and implicitly sets σ1=ϖ1/ϑ^(β),σ2=ϖ2/ϑ^(β). Then B~ sets h=ħ0, hi=ħ0βi, gβ=ς0βf^(β), Qi~=(ħ0βi/ϑ^(β))ϖ1, Ei~=(ħ0βi/ϑ^(β))ϖ2, e(g,h)=e(ς0,ħ0)f^(β). h, Qi~, Ei~ is computed from the challenge instance Y→. e(g,h) is calculated from ς0,ς0β,ς0β2,…,ς0βn-1,ς0βf^(β) and ħ0,ħ0β,f^(x). That is, e(∏i=0n-1(ς0βi)ci+1︹,ħ0β)·e(ς0c0︹,ħ0)=e(ς0∑i=-1n-1ci+1︹βi+1,ħ0)=e(ς0,ħ0)f^(β)=e(g,h). A~ obtains public parameter set PK={G,e(g,h),gβ,Qi~,Ei~,Hi~} from B~.
C o r r u p t ~ ( U ). Assume there is a participant U with U¯¯=<z1,z2,…,zn>, where U¯¯ does not satisfy AU1¯¯≥∗¯¯ and AU2¯¯≥∗¯¯, zi is the same definition as bi. B~ sets f⃑(β,U¯¯)=∏i=1n(β+H1(i))1-χi. B~ randomly chooses ν∈Zp and implicitly sets rU=σ1νβ/σ2 and sU=1/σ1·(1/f→(β,U¯¯)-σ2rU). B~ computes grU=(g0βf^(β))ϖ1ν/ϖ2. Without loss of generality, for AU2¯¯≥∗¯¯, B~ generates f(x)⃡=1/ϖ1·ϑ^(x)·f^(x)/f→(x,U¯¯), where ϑ^(x)=f⃑(x,AU2¯¯≥∗¯¯)=∏i=1n(x+H1(i))1-bi′, f^(x)=∏i=1n(x+H1(i))bi′. f(x)⃡ is a polynomial with at most n-1 degree since U¯¯ does not satisfy AU2¯¯≥∗¯¯. So, B~ computes ς0f(β)⃡ from ς0,ς0β,ς0β2,…,ς0βn-1, f(x)⃡ and sets gsU=ς0f(β)⃡(g0βf^(β))-ν. At last, A~ obtains KU={sU,rU} from B~.
S e n d ~ ( Π U 1 , U 2 k , m ). This enquiry denotes that after receiving a message m, oracle ΠU1,U2k executes the protocol and responds with an outgoing message m^. If ΠU1,U2kis the initiator of this session, we stipulate that the received message m is the security parameter λ. B~ establishes a initialized list Lk=(⊥1,⊥2,⊥3,⊥4,⊥5,⊥6) as empty list, where ⊥1,⊥2,…,⊥6 mean empty values. In our protocol, B~ maintains a list that saves the following information Lk=(ΠU1,U2k,x^,m,m^,KeyU1U2,KU1≫U2). Here, x^ is a random value selected by ΠU1,U2k. m^ is generated by ΠU1,U2k in response when ΠU1,U2k receives the message m. KeyU1U2 is the secret share from U1 and KU1≫U2 is the session key. When B~ receives the message m, the following works are done in turn.
(1) Ifm is the security parameter λ, ΠU1,U2kis the initiator of this session. There are 2 cases listed as follows:
(a) Ifk=k∗, then B~ does the following works. According to the challenging access structure AU2¯¯≥¯¯=<b1′,b2′,b3′,…,bn′>, B~ implicitly sets ιm1=ξ and Rm1=ς0βf^(β)ξ, σ1,m1=h0ϖ1ξ, σ2,m1=h0ϖ2ξ, and m^={AU2¯¯≥¯¯,Rm1,σ1,m1,σ2,m1}. B~ creates the record (ΠU1,U2k^,⊥2,⊥3,m^,⊥5,⊥6) in list Lk. Here, B~ denotes ξ with ⊥2 in Lk since B~ does not know ξ.
(b) Ifk≠k∗, then B~ carries out according to the specification of the protocol and updates the list Lk.
(2) Ifm is not the security parameter λ, there are 3 cases listed as follows.
(a) If there is no record(ΠU1,U2k,ξ′,m,m^,KeyU1U2,KU1≫U2) in list Lk, where ξ′ is an arbitrary value belonged to Zp, ΠU1,U2kis the responder of the protocol. B~ selects one random value ιm2∈Zp, and computes ξ′=H2(AU1¯¯≥¯¯,δm2),m^,KeyU1U2,KU1≫U2 according to the protocol and updates the list Lk.
(b) If there is the record(ΠU1,U2k,⊥2,⊥3,m^,⊥4,⊥5) in list Lk, ΠU1,U2k is just the object for test query and k=k∗. For the received m, B~ computes KeyU1U2=e(g,h)ιm2 and the session key KU1≫U2=H3(e(ς0,ħ0)f^(β)ξ)·H3(e(g,h)ιm2) according to the protocol. Then B~ updates the list Lk.
(c) If there is the record(ΠU1,U2k,ξ′,⊥3,m^,⊥4,⊥5) in list Lk, where ξ′ is an arbitrary value belonged to Zp, ΠU1,U2k is the sponsor. B~ carries out according to the specification of the protocol and updates the list Lk.
T e s t ~ ( Π U 1 , U 2 k ). A~ selects a fresh protocol participant ΠU1,U2k for test query.
IfΠU1,U2k is not the protocol participant guessed by B~ during the initialization phase, then B~ terminates the simulation. Otherwise, B~ returns the session key KU1≫U2=H3(e(ς0,ħ0)ξf^(β))·H3(e(g,h)ιm2).
R e v eal ~ ( Π U 1 , U 2 k ). If ΠU1,U2k or the matched protocol participants having sessions with participant ΠU1,U2k do not be issued the Test~(·) query to, B~ terminates simulation. Otherwise, B~ returns the corresponding session key value through accessing the query list Lk.
Output. when A~ completes all inquiries in Phase 1, A~ continues to ask the 3 inquiries: Corrupt~(·), Reveal~(·), Send~(·), which are not allowed to break the freshness of participants receiving the test inquiry. Once A~ decides to complete the inquiry, A~ outputs a bit κ′ as the stochastic value of the session key which is a conjecture and is used by B~ to distinguish e(ς0,ħ0)ξf^(β) from R.
Analysis. In the whole simulation process, the simulator B~ does not terminate the simulation with the probability of at least 1/NU2·QS. When the simulation of B~ is not terminated, A~ does not distinguish the security game simulated by B~ from the real security game. Therefore, if the advantage of guessing for A~ is ε, then that of guessing for B~ in the simulated security game is ε/NU2·QS.
IfR=e(ς0,ħ0)ξf^(β), the security game simulated by B~ is perfect. We get |Pr[B~(Y→,e(ς0,ħ0)f^(β)ξ)=0]-Pr[B~(Y→,R)=0]|=ε/(NU2·QS).
According to the above analysis, we construct a simulatorB~ solving aMSE-DDH problem with a nonnegligible advantage ε/(NU2·QS), if an attacker A~ wins the security game with advantage ε. Since it is inconsistent with the hypothesis of aMSE-DDH, our protocol satisfies the conditions shown in Definition 2 (2).
Besides, we suppose there exists a benign adversaryA~ who faithfully conveys messages. If U1,U2 execute the protocol in accordance with the protocol, they correctly receive messages from each other. Therefore, the two participants in the protocol finally calculate the same session key distributed over the key space uniformly. So it satisfies the conditions shown in Definition 2 (1).


## 6. Efficiency Analysis

### 6.1. Theoretical Analysis

We give a performance comparison between attribute-based key agreement protocols in [4] and our protocol. Some symbols are defined as follow: nA is denoted by the number of the attributes, which are involved in the system. TEGT︹, TEG︹ are exponentiation operation time on an element in group GT and that in group G, respectively. TP︹ is the pairing operation time. lA¯¯︹ is the number of the related attributes in the data access policy. lU︹ is the number of the related attributes in the private key. The comparison of computation cost is given in Table 1.Table 1
The comparison of computation cost.
Protocol K e y G e n e r a t i o n S e s s K e y G e n e r a t i o n (Encryption) S e s s K e y G e n e r a t i o n (Decryption) Protocol [4] ( 2 + 2 l U ︹ ) T E G ︹ T E G T ︹ + ( 1 + 2 l A ¯ ¯ ︹ ) T E G ︹ T E G T ︹ + ( 2 l U ︹ + 1 ) T P ︹  Our protocol 2 T E G ︹ T E G T ︹ + ( 1 + 2 l A ¯ ¯ ︹ ) T E G ︹ ( n A - l U ︹ ) T E G ︹ + 3 T P ︹ + T E G T ︹Our protocol has better performance in theKeyGeneration algorithm than that of [34]. The comparison of communication cost is given in Table 2.Table 2
The comparison of communication cost.
Protocol Communication cost Protocol [4] 2 ( l A ¯ ¯ ︹ + 1 ) | G | + | A U 1 , U 2 ∗ ¯ ¯ ~ |  Our protocol 6 | G | + | A U 1 , U 2 ∗ ¯ ¯ ~ |In the protocols, we denote|AU1,U2∗¯¯~| as the length of all data access structures, which are supposed to be 16 bits for every protocol. If lA¯¯︹≥3, our protocol has better performance in communication cost than that of [4].


### 6.2. Experimental Simulation

We conduct a simulation experiments on Windows 7 system with Intel(R) Core(TM) i7 CPU at 2.3GHZ and 4 GB RAM. The protocol is implemented by using the pairing-based cryptography library(PBC) library [45]. We use a symmetric elliptic curve a-curve, where the base field size is 512-bit. The a-curve has a 160-bit group order, i.e., p is a 160-bit length prime.To compare above protocol in actual operation, we run each protocol ten times, respectively, and compute the average values. We code all the algorithms by using c language under the default condition that each protocol contains 100 attributes in total, 50 attributes in access policy, 50 attributes in participants’ attribute set. The running results are shown in Figure3, from which we find out that the computation performance of our protocol being better than that of protocol in [4] overall. From Figure 4, our protocol has obvious advantage in the performance of communication if the number of attributes in data access structure is bigger than 3 (demarcation point). Our protocol is more practical in the resource constrained smart media and mobile environments. The theoretical analysis and simulation results are consistent, and our protocol achieves a high performance with good properties.Figure 3
Running time of each algorithm in both protocols.Figure 4
Communication costs of both protocols.


## 6.1. Theoretical Analysis

We give a performance comparison between attribute-based key agreement protocols in [4] and our protocol. Some symbols are defined as follow: nA is denoted by the number of the attributes, which are involved in the system. TEGT︹, TEG︹ are exponentiation operation time on an element in group GT and that in group G, respectively. TP︹ is the pairing operation time. lA¯¯︹ is the number of the related attributes in the data access policy. lU︹ is the number of the related attributes in the private key. The comparison of computation cost is given in Table 1.Table 1
The comparison of computation cost.
Protocol K e y G e n e r a t i o n S e s s K e y G e n e r a t i o n (Encryption) S e s s K e y G e n e r a t i o n (Decryption) Protocol [4] ( 2 + 2 l U ︹ ) T E G ︹ T E G T ︹ + ( 1 + 2 l A ¯ ¯ ︹ ) T E G ︹ T E G T ︹ + ( 2 l U ︹ + 1 ) T P ︹  Our protocol 2 T E G ︹ T E G T ︹ + ( 1 + 2 l A ¯ ¯ ︹ ) T E G ︹ ( n A - l U ︹ ) T E G ︹ + 3 T P ︹ + T E G T ︹Our protocol has better performance in theKeyGeneration algorithm than that of [34]. The comparison of communication cost is given in Table 2.Table 2
The comparison of communication cost.
Protocol Communication cost Protocol [4] 2 ( l A ¯ ¯ ︹ + 1 ) | G | + | A U 1 , U 2 ∗ ¯ ¯ ~ |  Our protocol 6 | G | + | A U 1 , U 2 ∗ ¯ ¯ ~ |In the protocols, we denote|AU1,U2∗¯¯~| as the length of all data access structures, which are supposed to be 16 bits for every protocol. If lA¯¯︹≥3, our protocol has better performance in communication cost than that of [4].


## 6.2. Experimental Simulation

We conduct a simulation experiments on Windows 7 system with Intel(R) Core(TM) i7 CPU at 2.3GHZ and 4 GB RAM. The protocol is implemented by using the pairing-based cryptography library(PBC) library [45]. We use a symmetric elliptic curve a-curve, where the base field size is 512-bit. The a-curve has a 160-bit group order, i.e., p is a 160-bit length prime.To compare above protocol in actual operation, we run each protocol ten times, respectively, and compute the average values. We code all the algorithms by using c language under the default condition that each protocol contains 100 attributes in total, 50 attributes in access policy, 50 attributes in participants’ attribute set. The running results are shown in Figure3, from which we find out that the computation performance of our protocol being better than that of protocol in [4] overall. From Figure 4, our protocol has obvious advantage in the performance of communication if the number of attributes in data access structure is bigger than 3 (demarcation point). Our protocol is more practical in the resource constrained smart media and mobile environments. The theoretical analysis and simulation results are consistent, and our protocol achieves a high performance with good properties.Figure 3
Running time of each algorithm in both protocols.Figure 4
Communication costs of both protocols.


## 7. Conclusion

Compared with protocol [4], our protocol has advantages in security and efficiency. The constant-size key and ciphertext make our protocol be more suitable for the application of lightweight level. We design the key agreement protocol between two principals based on attribute-based encryption. We prove its security under the AB-BJM model in the standard model. Our protocol has better computation and communication performance than that of existed protocols.A future research is trying to weaken the security assumption that the attacker is passive in AB-BJM model. Namely, one attacker does not have to execute the protocol faithfully to provide the messages for satisfying the requirement of the honest participator in a running of protocol. Such scene is closer to the true environment. In addition, it is an interesting topic to research the relation between the ABE and broadcast encryption [46, 47].



---

*Source: 8738960-2018-10-21.xml*