Cryptography Reference
In-Depth Information
g
α
j
,
τ
∗
,
a
j
∈
(1a)
F
j
(
a
j
)=
g
a
1
h
j
=
g
1
g
α
j
,
τ
∗
,.
j
∈
/
(1b)
-
Phase 1
A
makes secret key requests for any set of attributes
ω
=
{a
j
| a
j
∈
τ
∗
.Oneachrequest
B
chooses a random
Ω}
with the restriction that
ω
r
∈
Z
p
, and computes
d
0
=
g
(
−
1
/t
)
g
r
=
g
r−
(
b/t
)
,
2
d
j
=
g
(
−α
j
/t
)
F
j
(
a
j
)
r
=
g
(
−α
j
/t
)
(
g
1
g
α
j
)
r
=
g
2
F
j
(
a
j
)
r−
(
b/t
)
,
∀
a
j
∈
ω.
2
2
r
=
r
−
(
b/t
), then
d
0
=
g
r
,
d
j
=
g
2
F
j
(
a
j
)
r
,
∀
a
j
∈
ω.
Let
-
Challenge
A
outputs two messages
m
0
,m
1
∈
G
T
.
B
picks a random bit
b
∈{
0
,
1
}
, and returns the encryption of
m
b
. The encryption is generated as
follows.
1. Let
C
0
=
m
b
· Z
.
2. Set the value of the root node of
τ
∗
to be
g
c
, mark all child nodes as
un-assigned, and mark the root node assigned.
•
” and its child nodes are marked un-assigned,
for each child
a
j,i
except the last one
If the symbol is “
∧
Z
p
,
and assigns
C
j,i
=
g
s
i
,
C
j,i
=(
g
−s
i
)
α
j
to them, and to the last child it
assigns
C
j,i
=
g
s
v
=
g
c
/
(
v−
1
B
chooses random values
s
i
∈
i
=1
g
s
i
),
C
j,i
=(
g
s
v
)
−α
j
=
F
j
(
a
j
)
−s
v
.
Since
F
j
(
a
j
)=
g
α
j
when
a
j
∈
τ
∗
, the equality above holds.
•
∨
”, set the values of each child node to be
g
c
.Mark
If the symbol is “
this node assigned.
Hence, if
Z
=
e
(
g, g
)
abc
=
e
(
g
1
,g
2
)
c
,then
C
=(
C
0
, ∀a
j,i
∈ τ
∗
:
C
j,i
,C
j,i
)
is a valid encryption of
m
b
.
-
Phase 2
A
continues secret key requests with the same restriction as in
Phase 1
.
-
Guess
Finally,
outputs a guess
b
∈{
A
0
,
1
}
.
B
outputs a bit
u
∈{
0
,
1
}
as
the response to the DBDH problem.
If
b
=
b
,
lets
u
=1meaning
Z
=
e
(
g, g
)
abc
, otherwise lets
u
=0meaning
B
=
e
(
g, g
)
abc
.
Then the overall advantage of
Z
B
to solve DBDH problem is:
1
2
Pr
[
u
=1
Z
=
e
(
g, g
)
abc
]+
1
1
2
=
e
(
g, g
)
abc
]
|
2
[
u
=0
|
Z
−
=
1
Z
=
e
(
g, g
)
abc
]+
1
1
2
2
Pr
[
b
=
b
=
b
=
e
(
g, g
)
abc
]
|
2
Pr
[
b
|
Z
−
2
.
=
Search WWH ::
Custom Search