Oblivious Transfer with Complex Attribute-Based Access Control - Information Security and Cryptology-ICISC 2010 - page 383

ω ,where F j ( a j )= g a 1 h j ;

2. Compute d j = g 2 F j ( a j ) r ,foreach a j ∈

3. Return the secret key sk ω =( d 0 , ∀ a j ∈ ω : d j ).

- Encrypt( m, τ, pk ) To encrypt a message m ∈ G T , the algorithm proceeds as

follows.
1. First select a random element s

Z p , and compute C 0 = e ( g 1 ,g 2 ) s m .

2. Set the value of the root node of τ to be s , mark all child nodes as
un-assigned, and mark the root node assigned.
(a) If the symbol is “

∈ ·

” and its child nodes are marked un-assigned,
for each child node except the last one, we assign a random value s i
where 1

∧

≤ s i ≤ p − 1, and to the last child node assign the value

Σs i )mod p . Mark this node assigned.
(b) If the symbol is “

s t =( s −

∨ ”, set the values of each child node to be s .Mark

this node assigned.
3. For each leaf attribute a j,i ∈ τ , compute C j,i =( C j,i ,C j,i ), where C j,i =

g s i , C j,i = F j ( a j ) −s i ,where i denotes the index of the attribute in the
access tree τ .
4. Return the ciphertext C τ =( τ, C 0 , ( C j,i ,C j,i ): a j,i ∈ τ ).

Ģ s

s s

ġ Ģ

S 2 = s - S 1 S 3 = s S 4 = s

S 1

C j,1

C j,2 C j,3 C j,4

Fig. 1.

- Decrypt( C τ ,sk ω ) The algorithm chooses the smallest set ω ⊆

ω (we assume
that this can be computed eciently by the decryptor) that satisfies τ and
performs as follows.
1. For every attribute a j ∈

ω , compute

e ( d 0 ,C j,i ) e ( d j ,C j,i )

a j ∈ω

=
a j ∈ω

e ( g r ,F j ( a j ) −s i ) e ( g 2 F j ( a j ) r ,g s i )

=
a j ∈ω

e ( g r ,F j ( a j ) −s i ) e ( g 2 ,g s i ) e ( F j ( a j ) r ,g s i )

=
a j ∈ω

e ( g 2 ,g s i )

= e ( g 1 ,g 2 ) s

C 0

2. Compute m =

e ( g 1 ,g 2 ) s .