Cryptography Reference
In-Depth Information
A
who corrupts the same participants such that for any PPT distinguisher
sary
D|
Pr
[
Real
A
(
κ
)=1]
−
Pr
[
Ideal
A
(
κ
)=1]
|
is negligible in
κ
.
A
as follows.
A
plays simultaneously roles of
We construct an adversary
ˆ
ˆ
U
1
,...,
ˆ
ˆ
I
,
S
and a collection of cheating users
{
U
t
}
the issuer
,andperformsa
U
t
+1
,...,
ˆ
ˆ
A
runs
collection of honest users
{
U
n
}
in the real world.
A
to obtain
ˆ
ˆ
U
i
,ω
i
)
I
's public key
pk
I
and
Commit(H(
C
1
,...,C
N
))
from
S
. After receiving (
U
,ω
)inthereal
from
T
in the ideal world, it executes
ObtainCred
with
A
on (
A
worksastheissuerintheideal
world. If the resulting credentials are all valid,
world to return
b
=1 to
T
, otherwise return
b
=0.
A
extracts
sk
DB
from
A
in
the proof of knowledge in the
DB-Initialization
phase, and in the
Transfer
phase,
simulates honest users by requesting for
ω
for which it has the credentials. Upon
receiving the ciphertexts (
C
1
,...,C
N
),
A
decrypts the messages (
m
1
,...,m
N
),
and then sends
A
{
(
m
i
,τ
i
)
}
i
=1
,...,N
to
T
. If the transfer succeeds,
then sends
b
=1 to
, otherwise sends
b
=0.
We consider a sequence of distributions
Game-0
,
...
,
Game-3
to prove the in-
distinguishability between the real and ideal worlds. Let
Game i
be the output
of the
Game-i
.
T
Game-0
: In this game,
A
interacts with the honest users exactly in the real
world. Clearly
Pr
[
Game 0
=1]=
Pr
[
Real
A
(
κ
)=1]
.
Game-1
: The extractor for
PoK
1
of
sk
DB
is used to extract
sk
DB
.Ifextractor
fails or outputs invalid
sk
DB
, outputs “
”. Since the knowledge proof
PoK
1
is
zero-knowledge, the extractor fails with probability negligible in
κ
,andthereis
⊥
O
(2
−κ
)
.
|
Pr
[
Game 1
=1]
−
Pr
[
Game 0
=1]
|≤
Game-2
:Inthe
Transfer
phase, let the user algorithm request an attribute set
ω
for which it has the credentials. If the requests succeed, set a bit
b
=1, otherwise
b
=0. Since we assume that the blind ABE is selective-failure blind and the
knowledge proof
PoK
2
is zero-knowledge, then we have
O
(2
−κ
)
.
|
Pr
[
Game 2
=1]
−
Pr
[
Game 1
=1]
|≤
A
,wehavethat
From the construction of the adversary
Pr
[
Game 2
=1]=
Pr
[
Ideal
A
(
κ
)=1]
.
Summing the differences between the above games, we can conclude that
O
(2
−κ
)
.
|
Pr
[
Real
A
(
κ
)=1]
−
Pr
[
Ideal
A
(
κ
)=1]
|≤
O
(2
−κ
)
if the based blind
Lemma 3.
|
Pr
[
Game 2
=1]
−
Pr
[
Game 1
=1]
|≤
ABE is selective-failure blind.
Proof. If there exists a distinguisher
D
who can distinguish
Game 1
and
Game 2
,
then we can construct an adversary
who can win the selective-failure blindness
game. We use a hybrid proof as follows.
A
Search WWH ::
Custom Search