Attribute based encryption with direct efficiency tradeoff

Abstract

We propose the first fully secure unbounded Attribute-Based Encryption (ABE) scheme such that the key size and ciphertext size can be directly traded off. Our proposed scheme is parameterized by a positive integer d, which can be arbitrarily chosen at setup. In our scheme, the ciphertext size is O(t/d), the private key size is O(md), and the pub- lic key size is O(d), where t, m are the sizes of attribute sets and policies corresponding to ciphertext and private key, respectively. Our scheme can be considered as a generalization that includes two of the state-of-the-art ABE instantiations, namely, the unbounded ABE scheme and the ABE scheme with constant-size ciphertexts proposed by Attrapadung (Eurocrypt 2014). Indeed, these two schemes correspond to the two extreme cases of our scheme, that is, when setting d = 1 and when setting d as the maximum size of allowed attribute sets, respec- tively. Furthermore, our scheme also yields a tradeoff between encryp- tion and decryption time. Interestingly, when estimating efficiency using numerical parameters, the decryption time is minimized at d being some- where in the middle of the spectrum. We believe that this tradeoff can provide advantages in applications where size and/or time resources are concretely fixed in advance, as we can flexibly adjust d to match available resources and thus make the most of them. Such situations include, but are not limited to, implementations of ABE in tiny hardware tokens.