Cryptography Reference
In-Depth Information
g α j ,
τ ,
a j
(1a)
F j ( a j )= g a 1 h j =
g 1 g α j ,
τ ,.
j
/
(1b)
- Phase 1 A makes secret key requests for any set of attributes ω = {a j
| a j
τ .Oneachrequest B chooses a random
Ω} with the restriction that ω
r
Z p , and computes
d 0 = g ( 1 /t )
g r = g r− ( b/t ) ,
2
d j = g ( −α j /t )
F j ( a j ) r = g ( −α j /t )
( g 1 g α j ) r = g 2 F j ( a j ) r− ( b/t ) ,
a j
ω.
2
2
r = r
( b/t ), then d 0 = g r , d j = g 2 F j ( a j ) r ,
a j
ω.
Let
- Challenge
A
outputs two messages m 0 ,m 1
G T .
B
picks a random bit
b
∈{
0 , 1
}
, and returns the encryption of m b . The encryption is generated as
follows.
1. Let C 0 = m b · Z .
2. Set the value of the root node of τ to be g c , mark all child nodes as
un-assigned, and mark the root node assigned.
” and its child nodes are marked un-assigned,
for each child a j,i except the last one
If the symbol is “
Z p ,
and assigns C j,i = g s i , C j,i =( g −s i ) α j to them, and to the last child it
assigns C j,i = g s v = g c / ( v− 1
B
chooses random values s i
i =1 g s i ), C j,i =( g s v ) −α j = F j ( a j ) −s v .
Since F j ( a j )= g α j when a j
τ , the equality above holds.
”, set the values of each child node to be g c .Mark
If the symbol is “
this node assigned.
Hence, if Z = e ( g, g ) abc = e ( g 1 ,g 2 ) c ,then C =( C 0 , ∀a j,i ∈ τ : C j,i ,C j,i )
is a valid encryption of m b .
- Phase 2
A
continues secret key requests with the same restriction as in
Phase 1 .
- Guess Finally,
outputs a guess b ∈{
A
0 , 1
}
.
B
outputs a bit u
∈{
0 , 1
}
as
the response to the DBDH problem.
If b = b ,
lets u =1meaning Z = e ( g, g ) abc , otherwise lets u =0meaning
B
= e ( g, g ) abc .
Then the overall advantage of
Z
B
to solve DBDH problem is:
1
2 Pr [ u =1
Z = e ( g, g ) abc ]+ 1
1
2
= e ( g, g ) abc ]
|
2 [ u =0
|
Z
= 1
Z = e ( g, g ) abc ]+ 1
1
2
2 Pr [ b = b
= b
= e ( g, g ) abc ]
|
2 Pr [ b
|
Z
2 .
=
 
Search WWH ::




Custom Search