Oblivious Transfer with Complex Attribute-Based Access Control - Information Security and Cryptology-ICISC 2010 - page 390

A obtains a message set φ i from A sets fail. Otherwise, T .For j =1 ,...,N ,

C j ← Encrypt ( pk DB ,τ j ,m j )for m j ∈ φ i , and remains other ciphertexts to be

encryptions of random messages. At last A sends ( C 1 ,...,C N )to ˆ U i along with

a simulated proof of decommitment.
We consider a sequence of distributions Game-0 , ... , Game-3 to prove the in-
distinguishability between the real and ideal worlds. Let Game i be the output
of the Game-i .

Game-0 : The adversary A interacts with the honest server S exactly as in the

real world. Clearly

Pr [ Game 0 =1]= Pr [ Real A ( κ )=1] .

Game-1 : The extractor for the PoK 2 is used to extract ( id ,ω i ). If the extractor
fails or different identities are extracted, then output “

”. (If different identities
are extracted, there must be cheating users that collude with each other and try
to combine their credentials to retrieve the messages they have not access to.)
The difference between the two output distributions is given by the knowledge
error of the PoK 2 ,

⊥

O (2 −κ ) . | Pr [ Game 1 =1] − Pr [ Game 0 =1] |≤

Game-2 : If in the extracted ω i , there is at least one attribute a ω i which is not ∈

an element of Ω (i.e. a/ ”. The difference between Game-1

and Game-2 is given by the probability of forging a valid credential signature,

∈ Ω ), then output “ ⊥

O (2 −κ ) .

| Pr [ Game 2 =1] − Pr [ Game 1 =1] |≤

Game-3 : We replace the commitment withacommitmenttoarandomvalue,

and replace the final proof of knowledge of decommitment with a simulated
proof. For a secure commitment scheme and zero-knowledge proof, the difference
between this game and Game-1 is given by

C

D 's negligible advantage in correctly

distinguishing from a valid commitment to H ( C 1 ,...,C N ), and the simulated

proof from a valid proof,

C

O (2 −κ ) . | Pr [ Game 3 =1] − Pr [ Game 2 =1] |≤

Game-4 :Wedenotetheset φ i as the set of the messages whose access trees are
all satisfied by ω i , and denotes I ω i as the index of these messages. We alter the
ciphertext vector ( C 1 ,...,C N ) to produce a new vector ( C 1 ,...,C N ) as follows:
if j/ I ω i ,set C j ← Encrypt ( pk DB ,τ j ,m ), where m is selected randomly in the

message space, and otherwise C j ←

∈

C j .Thenwehave

O (2 −κ ) . | Pr [ Game 4 =1] − Pr [ Game 3 =1] |≤

A ,wehavethat

From the construction of the adversary

Pr [ Game 4 =1]= Pr [ Ideal A ( κ )=1] .