Constant-size ciphertexts in threshold attribute-based encryption without dummy attributes

• Main Authors: SUSILO, Willy, YANG, Guomin, GUO, Fuchun, HUANG, Qiong
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2018
• Subjects: Threshold attribute-based encryption; Constant size; Dummy attributes; Provable security; Data Storage Systems; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/7290; https://ink.library.smu.edu.sg/context/sis_research/article/8293/viewcontent/1_s2.0_S002002551731099X_main.pdf
• Institution: Singapore Management University

Attribute-based encryption (ABE) is an augmentation of public key encryption that allows users to encrypt and decrypt messages based on users' attributes. In a (t, s) threshold ABE, users who can decrypt a ciphertext must hold at least t attributes among the s attributes specified by the encryptor. At PKC 2010, Herranz, Laguillaumie and Raft& proposed the first threshold ABE with constant-size ciphertexts. In order to ensure the encryptor can flexibly select the attribute set and a threshold value, they use dummy attributes to satisfy the decryption requirement. The advantage of their scheme is that any addition or removal of the attributes will not require any change to users' private keys or public parameters. Unfortunately, the need for dummy attributes makes their scheme inefficient, since the computational cost of encryption is linear to the size of selected attribute set and dummy attribute set. In this work, we improve Herranz et al.'s work, and propose a new threshold ABE scheme which does not use any dummy attribute. Our scheme not only retains the nice feature of Herranz et al.'s scheme, but also offers two improvements in comparison to the previous work. Firstly, the computational costs of encryption and decryption are only linear in the size of the selected attribute set. Secondly, without any dummy attribute, most of the computations can be conducted without the knowledge of the threshold t. Hence, threshold change in the encryption phase does not require complete recomputation of the ciphertext. (C) 2017 Elsevier Inc. All rights reserved.