mR_LWE-CP-ABE: A revocable CP-ABE for post-quantum cryptography

1.1 Related works

ABE, first proposed in the study by Sahai and Waters [5], is an asymmetric cryptographic primitive for one-to-many encryption that, as highlighted by high number of surveys in the last few years on it [6–10], attracted many interests along the years as it provides fine-grained access control over data. An ABE scheme allows a data owner to encrypt some data once and to share them with many along with a set of required attributes that define an access policy; the set of valid recipients is not required to be known in advance: all we need is that an authorised user must retain a set of valid attributes that satisfy the access policy. Each user is identified by the set of attributes of his/her owns. Over the years, two variants of ABE have been proposed in the literature: the CP-ABE [11] and the Key Policy Attribute-Based Encryption (KP-ABE) [12]. In CP-ABE, the access policy is applied to the ciphertext, conversely, in KP-ABE it is associated with the secret key, so usually CP-ABE is preferred as it is more flexible. Different from classical public key schemes where a user who wants to share encrypted data with many others is required to perform many encryptions, one for each of valid recipient, in ABE schemes, the encryption is performed only once for many users: for this reason, in cloud environments, ABE schemes are a common choice. However, in this context, usually, the set of users changes frequently so the ability to revoke some users is a necessary requirement for any ABE scheme.

In the literature [13], the revocation mechanism was categorised into three classes: direct, indirect, and server-aided.

The direct revocation follows the approach of conventional public key management systems (PKMS) where a certificate revocation list (CRL) is distributed. Once a user needs to be revoked, the key authority in the PKMS adds the user identifier to the CRL and shares the updated list. Some examples of ABE schemes that implement direct revocation were given in the studies by Liu et al. [14] and Phuong et al. [15]. The major drawback of direct revocation is, of course, related to the distribution of the updated CRL. Any data owner must update his/her CRL before encrypting new data to exclude revoked users. Furthermore, as the revoked user set grows, so does the size of the CRL. Liu et al. [14] proposed a solution to overcome both issues by setting expiration dates on keys, by embedding the revocation list along with the ciphertext, and by removing revoked keys from the list once expired; however, in such schemes, data owner still needs to update his/her CRL to be sure not to miss any recently revoked user.

In indirect revocation, every time a user is revoked, the key authority generates new keys only for the remaining non-revoked users. The benefit of this approach is that the server only needs to work on the subset of still active users and does not need to periodically share the CRL. A few examples of CP-ABE indirect revocable schemes were mentioned in the studies by Sahai et al. [16] and Yu et al. [17] and in the study by Xie et al. [18]. For instance, in both studies by Sahai et al. [16] and by Yu et al. [17], the authors proposed to update both the keys for still active users and the older ciphertexts, stored on the cloud, to not letting a revoked user to decrypt them anymore. The approach proposed in in the study by Xie et al. [18] is slightly different: they update the keys but each user has two different keys, an individual and a group key, both needed for the decryption.

Server-aided revocation solutions try to avoid the need for key updates and the distribution of the CRL. They required, as the system we propose in this article, to leverage third-party cooperation to decrypt. Here, following the approach first proposed in the study by Boneh et al. [3] and then applied also in the studies by Yang et al. [19] and Cul et al. [20], we rely on key-splitting feature for the revocation. Different from the literature, to the best of our knowledge, mR_LWE-CP-ABE is the first application of such a revocation technique to a lattice-based ABE scheme; we believe this is an important step as our system, uniquely with respect to all the previous works, is embedded in a post-quantum secure environment.

1.2 Contributions

Here, in the following, we list the main contributions of this work

• Inspired by the study by Boneh et al. [3], we propose mR_LWE-CP-ABE the first, to the best of our knowledge, CP-ABE revocation scheme based on lattices, a presumed post-quantum resistant algebraic setting. We start with the CP-ABE scheme presented in the study by Zhang and Zhang [2], and we extend and modify it to support key revocation. We rely on (semi)trusted third party, called the security mediator, to perform fast and efficient user key revocation.

• We provide a formal description of the proposed scheme along with the analysis of its parameter and its security proof.

• We implement mR_LWE-CP-ABE scheme on Palisade, a well-known crypto library, and we experimentally evaluate the overhead introduced by the revocation mechanism in terms of performance.

• We will release the implementation of our scheme to let the community independently test and evaluate it.

1.3 Organisation of the article

The rest of this article is organised as follows. Section 2 wraps up the notation and the mathematical basics used in the rest of this article. Section 3 reviews the mathematical background used throughout this article (a confident reader can safely skip this section): in particular, the SIVP problem (Section 3.1), the discrete Gaussian (Section 3.2), the learning with error problem (Section 3.3), and some useful algorithms on lattices (Section 3.4) are recalled. Section 4 introduces the system model of CP-ABE (Section 4.1) and analyses the scheme presented in the study by Zhang and Zhang [2] by reworking its definition (Section 4.2) and analysing its parameters (Section 4.3), providing a few small changes in the notation to better prepare the ground for the mediated scheme. Section 5 holds the main contribution of the article, defining the mediated CP-ABE system model (Section 5.1), introducing the novel scheme (Section 5.2), and analysing its parameters (Section 5.3). Section 6 analyses both the threat model (Section 6.1) and the classical security (Section 6.2) of the proposed scheme. Section 7 introduces the multi-bit variation on the original and mediated scheme, following the build from the study by Zhang and Zhang [2]. Section 8 presents some benchmarks and results on the proposed scheme. Finally, Section 9 closes this article resuming the contributions and providing some hints on future works.

3.1 Hard problems

Many cryptographic primitives have been constructed whose security is based on the (worst-case) hardness of SIVP or closely related lattice problems. In particular, the (worst-case) hardness of the SIVP for poly ( n ) approximation factors implies the existence of several fundamental cryptographic primitives. Blömer and Seifert [21] showed that the SIVP is NP-hard to approximate for any constant approximation factor γ . Their result is shown only for the Euclidean norm, and their proofs were extended to arbitrary norms by the study by Aggarwal and Chung [22].

The norm of vector x , denoted by ‖ x ‖ , is defined with respect to integer p :

We write SIVP p as a notation respective to p . Hence, SIVP 2 is the case considered in the study by Blömer and Seifert [21].

Hereinafter, we suppose fixed p = 2 and we omit from explicitly mentioning it in the norm.

A basic parameter of the lattice Λ is the length of the shortest non-zero vector in the lattice. The parameter λ 1 is also indicated as the first successive of Λ and denoted by λ 1 . It is important to know the lower and upper bounds for λ 1 , which, of course, depend on p : a lower bound is given by the length of the shortest vector in the Gram–Schmidt reduced form of the basis: λ 1 ≤ min i ‖ b ˜ i ‖ . Similarly, for i = 1 , … , n , the i -th successive minimum, denoted by λ i ( Λ ) , is the smallest l such that there are i non-zero linearly independent lattice vectors that have length at most l .

The SIVP consists in finding n independent and “short” vectors: given a basis B ∈ Z n × n , find independent vectors u 1 , … , u n such that ∣ ∣ u i ∣ ∣ ≤ λ n for i = 1 , … , n , [23].

The Gap-Exponential Time Hypothesis is a fine-grained complexity-theoretic hypothesis introduced in the study by Impagliazzo and Paturi [24], and it is required to exclude sub-exponential algorithms.

3.2 Discrete Gaussians

We recall the definition of Gaussian function centred in c and scaled by a factor of s to be

A Gaussian function is typically used to build (continuous) probability distributions as:

being s N = ∫ x ∈ R n ρ s , c ( x ) d x the total measure associated with ρ s , c .

Given a lattice Λ ⊂ Z n , we can discretise the distributions D s , c on it by distributing x ∈ R n according to D s , c and conditioning x ∈ Λ , thus obtaining

with ρ s , c ( Λ ) being the proper normalisation constant evaluated as ρ s , c ( Λ ) = ∑ y ∈ Λ ρ s , c ( y ) . We call such distribution a discrete Gaussian function with centre c and parameter s , and we omit the subscripts s and c if equal, respectively, to 1 and to the origin 0 .

Given a parameter ε ∈ R + , we further recall from the study by Micciancio and Regev [25] the definition of smoothing parameter η ε as:

In particular, if s ≥ η ε , we can bound the dispersion of the Gaussian as per the following.

3.3 LWE

Originally presented in the study by Regev [1] and later extended in the study [26], LWE is a hard lattice problem founding in Fully Homomorphic Encryption. Its hardness has been proven in the study by Regev [1] via a quantum reduction to SIVP and GapSVP and in the study by Peikert [27] via a classical reduction to a variation of GapSVP.

Let q ∈ N and let χ be a probability distribution on Z q . For any s ∈ Z q n , LWE instances with secret s are defined as samples from:

LWE can be either formulated as a search or a decision problem, being the first to recover s given multiple samples of A s , χ and the second to distinguish between A s , χ and U ( Z q ) n × U ( Z q ) . In particular, if q = poly ( n ) , the two problems are polynomially equivalent [26]. In the following, we denote with LWE q , χ a generic instance of LWE with a specific parameter q ∈ N .

Let us denote by Ψ α , a periodisation of the normal distribution with mean 0 and variance β 2 2 π and by Ψ ¯ α its discretisation, then we have:

More formally, for r ∈ [ 0 , 1 ) , we have

and

In particular, we can characterise the distribution Ψ ¯ α m as follows:

3.4 Literature algorithms on lattices

In the following, we recall four algorithms from the literature that are later used both in the original CP-ABE scheme and in mR_LWE-CP-ABE.

4.1 System model

A CP-ABE scheme is a framework to perform secure data sharing where recipients are not specific users – like in classic PKE schemes – but rather users with specific attributes. A trusted central authority is needed for what concerns user key creation; however, data encryption and decryption can be performed without its further collaboration; in particular, also data owners outside the accredited users can encrypt data.

More formally, we have

Following the structure of the original article [2], we propose the selective chosen plaintext attack (sCPA) for assessing security. In sCPA, a challenge access structure W is initially specified by the attacker and then an interactive game is run. In the game, the attacker submits two plaintexts, one of which is randomly chosen and encrypted by the challenger. The attacker is then required to determine which plaintext corresponds to the given ciphertext.

More formally, consider the following indistinguishability game (IND-sCPA) between a challenger C that acts as a central authority and an adversary A that acts as an attacker:

Init. A chooses a challenge access structure W and prompts it to C .

Setup. C performs all the setup tasks and eventually prompts the public key pk to A .

Key generation queries. A is allowed us to make a polynomial number of adaptive key generation queries on any attribute specification S such that S ⊬ W .

Challenge. A submits two messages of equal length M 0 and M 1 to C , who randomly chooses b ∈ { 0 , 1 } and returns to A the ciphertext associated with M b , i.e. returns Enc ( pk , W , M b ) .

Guess. A is allowed us to perform one more round of Key generation queries and eventually outputs a bit b ′ .

The advantage of an adversary A w.r.t. the previous game is defined as:

We can further define a CP-ABE scheme to be secure against sCPA if, for any polynomial time adversary A , the advantage Adv A IND-sCPA ( σ ) is a negligible function in the security parameters σ .

As shown in the recent literature (see e.g., [32]), carefulness should, however, be made if protocol security is obtained via classical proofs, since their translation to the post-quantum context (in particular when interactive proofs are considered, like in this case) is not guaranteed. In light of these recent results, in the present work, we only discuss classical security. More work is to be carried out in this direction; although the scheme here presented is based, under the LWE assumption, on a problem that is commonly thought to be hard also in a quantum computing setting, the security of the scheme is assessed as in the study by Zhang and Zhang [2] only against a classical attacker.

4.2 Scheme

The scheme we work on was originally introduced by Zhang and Zhang [2], and it is somehow inspired by Shamir Secret Sharing [33] technique, where a randomly chosen shared secret s ← $ Z q n is hidden through multiple LWE samples and it is used in a LWE-PKE [29] fashion to build a ciphertext.

The main idea is to provide a given user with a fixed attribute (say 0) and a set of variable attributes ℛ = { 1 , … , ∣ ℛ ∣ } that can either be assigned (say i + ) or not (say i − ) for a total of r = ∣ ℛ ∣ + 1 attributes. Then, access structures W can either specify a given attribute (both in a positive or in a negative way) or not (actually providing them both).

More formally, a user attribute specification is a 2-partition S = ( S + , S − ) of ℛ (i.e., S + ∪ S − = ℛ and S + ∩ S − = ∅ ), while an access structure is a 2-covering W = ( W + , W − ) of ℛ (i.e. W + ∪ W − = ℛ , but W + ∩ W − = ∅ is not required), where S + and W + represent the sets of positive attributes; moreover, S − and W − are the sets of negative attributes. In particular, we say that user attributes S satisfy the access structure W if S + ⊆ W + and S − ⊆ W − : in such case, we write S ⊢ W ; otherwise, we write S ⊬ W .

The advantage of providing user-attribute specifications as 2-partition consists in always having the same number of attributes, hence being able to build a matrix D ∈ Z q n × m r to be used in GenSamplePre. At the same time, the fixed attribute 0 provides an excellent point to evaluate the short basis needed by GenSamplePre(hence assuming J = { 0 } ): in fact, it is fixed amongst all the possible user attribute specifications and it can be pre-evaluated efficiently via TrapGen algorithm.

Formally, the scheme is parameterised on the modulus q , the dimension m , the security parameter n , the Gaussian parameter s , and the error distribution χ with parameter α . Requirements on these parameters are analysed later in the next section.

The definition of the four functions from Scheme 1 are provided in Algorithms from 1 to 4.

4.3 Parameter requirements and security

We analyse the scheme parameters considering the requisites (i) of having a correct decryption (cf. Algorithm 4), (ii) required by Proposition 2, and (iii) required by Functions 1–4. Then, we obtain:

1. m ≥ ⌈ 6 n log q ⌉ as required by TrapGen (Function 2);

2. s ≥ ‖ T ˜ B 0 ‖ ⋅ ω ( log ( m r ) ) as required by GenSamplePre (Function 4) and by the security proof;

3. ∣ x z − x ′ ∣ ≤ q ℓ , with ℓ > 4 , for correct decryption (Algorithm 4);

4. α q ≥ 2 n for LWE hardness (Proposition 2).

( i ) suggests us to parameterise m over a value δ ∈ R being such that n δ > ⌈ log q ⌉ , thus obtaining

Furthermore, we know from Function 2 that ‖ T ˜ B 0 ‖ ≤ O ( n log q ) , or, in other terms, that ‖ T ˜ B 0 ‖ ≤ O ( m ) ; hence, from the second condition, we obtain

In order to tackle ( i i i ) , we recall from Lemma 2 that ∣ x z ∣ ≤ q α ⋅ ω ( log m ) + 1 2 and ∣ x ′ ∣ = ∣ ⟨ e T , x ⟩ ∣ ≤ ‖ e ‖ ⋅ q α ⋅ ω ( log m ) + ‖ e ‖ m 2 and from Lemma 1 that ‖ e ‖ ≤ s m r ; hence, due to triangular inequality, we obtain

Plugging the inequality in ( i i i ) and letting ω ˆ = ω ( log ( m r ) ) , we obtain

which suggests us requiring

hence obtaining from the previous inequality that

Furthermore, in order to satisfy ( i v ) , we obtain

Recalling from ( i ) that m > 4 n , a suitable solution is given by:

solution yet still satisfying the sequence of inequalities we built for ( i i i ) .

We can resume the above-stated conditions as follows:

in order to provide the scheme security claim.

5.1 The system model

We rely on a new server-aided approach to provide a fast and reliable solution in order to avoid some inefficiency intrinsically derived by direct and indirect revocation mechanisms. Our system is logically composed by four kinds of entities:

• the key generation server (KGS): a trusted server that is able to generate a public key and, for each user, the corresponding secret key.

• A set of k SM: each SM is a semi-trusted entity that has access to the mediator keys of a (sub)set of users.

• The data owner: someone who wants to encrypt some data for a set of, possibly unknown, users.

• A set of users that belong to the system: each user has an attribute specification that specifies his/her access rights. The attributes are associated with the secret user key generated by the KGS.

We define our scheme on top of the one introduced in Section 4.2; namely, for each user, the KGS generates a tuple of keys, ( sk , mk 1 , … , mk k ) ; the sk is the user key and it is given to the user while the keys mk j , with 1 ≤ j ≤ k , are the mediator keys that are distributed one for each SM involved. In order for a user to successfully decrypt a ciphertext, two conditions are required: first, as usually in CP-ABE, the user must have an attribute specification S that satisfies the ciphertext policy; second, all the k SMs must contribute to the decryption.

If a user is revoked, the KGS only needs to send this information to the SMs that have a mediator key for that user and they will stop to collaborate in the decryption process. In particular, it is sufficient that just a single SM refuses to cooperate to defeat the decryption process. This guarantees that, if at least one SM follows the protocol, a revoked user cannot decrypt anymore.

Please note that, differently from previous schemes in the literature, we do not require to update keys or re-encrypt ciphertexts, in order to revoke a user, we just need to notify the SMs. Furthermore, already encrypted ciphertexts that have not been decrypted before revoke occurs, are evenly secure against the revoked user. This is also different from direct revocation where the CRL, as this revocation process does, does not involve the encryption process. In order to support fast and secure revocation, our system incurs, of course, in some overhead compared to that in the study by Zhang and Zhang [2]. For instance,

• The KGS has to generate k + 1 keys for each user;

• The decryption process of a ciphertext C requires k + 1 partial decryption plus k error generation that is added by each SM to protect their mediator keys.

It is important to highlight that, despite SM’s need to be reachable at decryption time, hence making the protocol interactive, the approach preserves the advantages of CP-ABE over classical PKE schemes. In fact, data owners still produce encrypted data offline and without suffering any overhead w.r.t. non-mediated CP-ABE schemes. Furthermore, access to data is still preserved by data owners and final users only, since SMs have blind-access to data.

It is, however, important to note that the here proposed scheme is weak against any kind of denial of service attack since being a single SM unreachable or uncooperative causes the decryption procedure to fail. This outcome is common in any ( k , k ) secret sharing scheme, where k participants out of k are required to collaborate to retrieve the key. Just analogously to secret sharing schemes, it is hence possible, depending on the use case requirement, to mitigate this issue by building a ( t , k ) threshold scheme where only t out of k SMs are required to carry out the partial decryption. Simpler solutions are also available, e.g., the possibility to give SM keys with a certain amount of redundancy, actually creating a (possibly) non-homogeneous network of SMs. Such a solution also allows us to distribute the decryption workload amongst multiple parties. Further description of these approaches is, however, out of the scope of this article and will be the object of further future analysis.

5.2 Scheme

mR_LWE-CP-ABE shares the same parameter structure with the regular CP-ABE scheme presented in Section 4. Requirements on these parameters are very similar too and are discussed in the next section. For this reason, Setup function is defined as in Algorithm 1 without any particular changes.

Concurrently, as described in Section 5.1, the encryption procedure is not modified by the mediation process; hence, Enc function is defined as in Algorithm 3.

The definition of the three remaining functions defining a revocable CP-ABE scheme follows in Algorithms 5 to 7.