Insecurity of an IBEET Scheme and an ABEET Scheme

Cloud computing is a novel pattern, which can allow users to outsource their data to the cloud servers in order to save the resource of clients. For the sake of protecting the clients' privacy, the clients' data are stored or computed in the encrypted data. This leads to a new issue: how to quickly search these encrypted data. One of the methods to solve the problem is to construct public-key encryption schemes with the equality test. In this paper, we point out that an identity-based encryption scheme with the equality test and a ciphertext-policy attribute-based encryption scheme with equality test is not secure on their security models, respectively.

SECTION I. Introduction

In cloud computing environment, users are allowed to outsource their data to cloud severs. In order to protect the privacy of data of users, these outsourced data have to be stored in an encrypted form. However, in order to efficiently extract some statistical information of the data for users in the future, it is necessary to search some information from the encrypted data in the cloud firstly.

This novel application brings many new security issues, such as auditing [1], outsourcing computation [2], [3], outsourcing verification [4] and encrypted data searching [5]. Boneh et al. [5] introduced a new concept — public key encryption with keyword search (PKEKS), which can search a keyword over the encrypted data but cannot decrypt it. Later, Yang et al. [6] put forward another new concept—public key encryption with equality test (PKEET), which combines the public key encryption (PKE) and searchable encryption (SE). The PKEET cannot only decrypt the encrypted keyword, but also can check if ciphertexts are encryptions of the same unknown keyword even if it is possible to use different public keys. Tang [7] proposed a PKEET with fine-grained authorization scheme (PKEET-FG), an extension of PKEET-FG [8] and all-or-nothing PKEET (AON-PKEET) [9] to improve the scheme. Ma et al. [10] presented a PKEET supporting flexible authorization (PKEET-FA). In their scheme there are 4 types of flexible authorizations. In order to simplify the certificate management of PKEET, Ma [11] presented an identity-based encryption with equality test (IBEET), and showed that the scheme was one-way secure under chosen ciphertext attack (OW-CCA). Also, Lee et al. [12] presented semi-generic construction of IBEET scheme and PKEET scheme, but their constructions need to use the encryption algorithm twice and a one-time signature, which aren’t efficient. Zhang and Xu [13] and Zhang et al. [14] proposed two schemes from lattices, which can be considered secure under quantum computing attacks. In order to make the scheme more flexible, Zhu et al. [15] and Wang et al. [16] proposed a key policy attribute based encryption scheme with equality test (KP-ABEET) and ciphertext policy attribute based encryption scheme with equality test (CP-ABEET) respectively and showed their corresponding security. However, Liao et al. [17] showed that the KP-ABEET scheme [15] wasn’t secure on their security model.

In this article, we analyze the security of IBEET and CP-ABEET as follows. We firstly prove that the IBEET scheme proposed by Ma isn’t one-way under chosen ciphertext attack and then we set forth the reason of insecurity and give some idea to improve the scheme. Next we prove that the CP-ABEET scheme proposed by Wang et al. isn’t indistinguishable against chosen plaintext attack in the standard model.

The rest of this paper is organized as follows. In section II, we recall basic concepts which will be used in the paper. We then recall an IBEET scheme proposed by Ma and show that the scheme isn’t secure based on their security models and improve the scheme in section III. In section IV we recall a CP-ABEET scheme proposed by Wang et al. and show that the scheme isn’t IND-CPA secure in the standard model. Finally, we conclude the paper in section V.

SECTION II. Preliminary

Here, we first recall some basic mathematical knowledge which will be used.

A. Bilinear Pairing

Let $\mathbb {G}$ and $\mathbb {G}_{\mathrm {T}}$ be two multiplicative groups which have the same prime order $q,~\mathbb {Z}_{q}^{*}$ be the multiplicative group of the finite field $\mathbb {F}_{q}$ . A bilinear map $e: \mathbb {G} \times \mathbb {G} \rightarrow \mathbb {G}_{\mathrm {T}}$ [18], which satisfies the following three properties:

• Bilinearity: For any $u,v,w \in \mathbb {G}$ ,\begin{align*} e(u,vw)=&e(u,v) e(u,w),\quad \mathrm {and} \\ e(uv,w)=&e(u,w) e(v,w).\end{align*}

• Non-degeneracy: There are elements $g_{1},g_{2} \in \mathbb {G}$ , such that $e(g_{1},g_{2}) \neq 1_{G_{\mathrm {T}}}$ , where $1_{G_{\mathrm {T}}}$ is the identity element of $\mathbb {G}_{\mathrm {T}}$ .

• Computability: For any elements $g_{1},g_{2} \in \mathbb {G}$ , there is an efficient algorithm to compute $e(g_{1},g_{2})$ .

Definition 1:

Bilinear Diffie-Hellman problem (BDH problem). Let $\mathbb {G}_{1}$ and $\mathbb {G}_{T}$ be the groups of the same prime order $q$ above. Given $(g, g^{c}, g^{b}, g^{a}) \in \mathbb {G}^{4}$ for some $a,b,c \in \mathbb {Z}_{q}^{*}$ , to compute $e(g, g)^{abc}$ . Where $g$ isn’t the identity element of $\mathbb {G}$ and $e: \mathbb {G} \times \mathbb {G} \rightarrow \mathbb {G}_{\mathrm {T}}$ .

Definition 2:

Twin-decision bilinear Diffie-Hellman problem (t-DBDH problem). Given two distributions \begin{align*} D_{0}=&\{g,g^{a},g^{b},g^{c},g^{u},g^{v},e(g,g)^{abc}, \\&e(g,g)^{auv}: a,b,c,u,v \in \mathbb {Z}_{q}\} \\ D_{1}=&\{g,g^{a},g^{b},g^{c},g^{u},g^{v},e(g,g)^{d}, \\&e(g,g)^{w}: a,b,c,d,u,v,w \in \mathbb {Z}_{q}\}\end{align*} to decide whether $abc\equiv d ~ \mathrm {mod} ~q$ and $auv\equiv w ~ \mathrm {mod} ~q$ hold or not.

B. Model of IBEET and ABEET

An IBEET and ABEET include three entities, the key generator center (KGC), users and the cloud server, which are described in FIGURE 1. The KGC generates the private key of a user’s identity in IBEET and sets of attributes in ABEET, respectively. The users create their trapdoors by using their private keys and ciphertexts. The cloud server stores the users’ data (ciphertexts) and runs the test algorithm when it receives the corresponding trapdoors. The users receive their private keys over secure channels and the cloud server gets the ciphertexts and trapdoors over open channels which can be eavesdropped by adversaries.

FIGURE 1.

Model of IBEET and ABEET.

SECTION III. Insecurity of an IBEET Scheme

A. Syntax of IBEET

An IBEET scheme [11] includes six algorithms: Setup, Extract, Enc, Dec, Trapdoor and Test. Let $\mathbb {M}$ and $\mathbb {C}$ be its plaintext space and ciphertext space, respectively.

• $\mathbf {Setup}(k)$ : On input a security parameter $k$ , the algorithm outputs public system parameters $K$ and a master key $msk$ .

• $\mathbf {Extract}(msk, ID)$ : On input $msk$ and an arbitrary identity $ID\in \{0,1\}^{*}$ , the algorithm outputs a private key $sk_{ID}$ for an identity $ID$ .

• $\mathbf {Enc}(ID, M)$ : On input an identity $ID\in \{0,1\}^{*}$ and a plaintext $M\in \mathbb {M}$ , the algorithm outputs a ciphertext $C\in \mathbb {C}$ .

• $\mathbf {Dec}(sk_{ID}, C)$ : On input a ciphertext $C\in \mathbb {C} $ and a private key $sk_{ID}$ , the algorithm outputs a plaintext $M\in \mathbb {M}$ .

• $\mathbf {Trapdoor}(sk_{ID_{A}}, C)$ : On input the private key $sk_{ID_{A}}$ of identity $ID_{A}$ of a user $A$ and a ciphertext $C\in \mathbb {C}$ encrypted some plaintext by using $ID_{A}$ , the algorithm outputs a trapdoor $td_{A}$ . If $C$ is empty string(ciphertext), then that means all ciphertexts correspond to the same trapdoor $td_{A}$ .

• $\mathbf {Test}(C_{A}, td_{A}, C_{B}, td_{B})$ : On input a ciphertext $C_{A} \in \mathbb {C}$ , a trapdoor $td_{A}$ for an identity $ID_{A}$ , and a ciphertext $C_{B} \in \mathbb {C}$ , a trapdoor $td_{B}$ for an identity $ID_{B}$ , the algorithm outputs “1” if $C_{A}$ and $C_{B}$ are generated by the same plaintext; Otherwise it outputs “0”.

B. Security Model of IBEET

We recall the definition of the security concept of one-way against chosen ciphertext security(OW-ID-CCA) for IBEET scheme [11].

$GAME~1$

• Setup: On input a security parameter $k$ , the challenger $\mathcal {C}$ produces the system parameters $K$ by running the Setup algorithm. Then $\mathcal {C}$ sends $K$ to the adversary and keeps the master key $msk$ by itself.

• The Phase 1

  • Private key queries. The challenger $\mathcal {C}$ produces a private key $sk_{i}$ of an identity $ID_{i}$ by running the Extract algorithm. Then $\mathcal {C}$ sends the private key $sk_{i}$ of identity $ID_{i}$ to adversary $\mathcal {A}$ .

  • Trapdoor queries $TD_{i}$ . At any time, in order to obtain a trapdoor of an identity $ID_{i}$ , on input identity $ID_{i}$ , the adversary $\mathcal {A}$ can query trapdoor oracle. The challenger gets trapdoor $td_{i}$ by running the above private key queries on $ID_{i}$ , and then sends the trapdoor $td_{i}$ to $\mathcal {A}$ .

  • Decryption queries $(ID_{i}, C_{i})$ . The challenger decrypts the ciphertext $C_{i}$ by running the decryption oracle, and then sends the $M_{i}$ , which is an output of the decryption oracle, to adversary $\mathcal {A}$ .

• Challenge: Firstly the adversary $\mathcal {A}$ decides to submit an challenge identity $ID^{*}$ which she/he selects. The only restricted condition is that $ID^{*}$ didn’t appear in the private key queries in the phase 1, however $ID^{*}$ may be in the decryption queries $(ID^{*}, \cdot)$ or in the trapdoor queries. Then the challenger $\mathcal {C}$ randomly selects a plaintext $M^{*}\in \mathcal {M}$ and finally sends the challenge ciphertext $C^{*}=\mathrm {Enc}(ID^{*},M^{*})$ to $\mathcal {A}$ .

• The Phase 2.

  • Private key queries. If $ID_{i} \not =ID^{*}$ , then the challenger $\mathcal {C}$ responds it as that in the phase 1.

  • Trapdoor queries $TD_{i}$ . For any identity, the challenger $\mathcal {C}$ responds it as that in the phase 1.

  • Decryption queries. If any ciphertext $(ID_{i}, C_{i})~ \neq ~(ID^{*},C^{*})$ , then the challenger $\mathcal {C}$ responds it as that in the phase 1.

• Guess: $\mathcal {A}$ submits a guess $M' \in \mathcal {M}$ .

We call an adversary $\mathcal {A}$ to be a OW-ID-CCA adversary in the above game [11]. And the advantage of the OW-ID-CCA adversary is the probability that the adversary $\mathcal {A}$ wins the game, that is \begin{equation*} Adv^{OW-ID-CCA}_{\mathrm {IBEET},\mathcal {A}}(k)=\mathrm {Pr}[M=M'].\end{equation*}

Definition 3:

We call an IBEET scheme to be OW-ID-CCA secure, if for all OW-ID-CCA adversaries, $Adv^{OW-ID-CCA}_{\mathrm {IBEET},\mathcal {A}}(k)$ is negligible in the security parameter $k$ .

C. Recall the Ma’s IBEET Scheme and its Security Analysis

Before we analyse the Ma’s IBEET scheme [11], we firstly recall it.

1) Recall the Ma’s IBEET Scheme

The construction of their scheme is as follows.

• Setup: On input a security parameter $k$ , it works as follows:

  • Produce some public parameters: two multiplicative groups $\mathbb {G},\mathbb {G}_{\mathrm {T}}$ of prime order $p$ , and an admissible bilinear map $e: \mathbb {G}\times \mathbb {G} \rightarrow \mathbb {G}_{\mathrm {T}}$ with a random generator $g\in \mathbb {G}$ . Randomly select three cryptographic hash functions: $H_{1}:\{0,1\}^{*} \rightarrow \mathbb {G},\,\,H_{2}: \mathbb {G}_{\mathrm {T}}\rightarrow \mathbb {G},\,\,H_{3}:\mathbb {G}_{\mathrm {T}} \rightarrow \{0,1\}^{l_{1}+l_{2}}$ , where $l_{1}$ and $l_{2}$ are length of elements in $\mathbb {G}$ and $\mathbb {Z}_{p}$ , respectively.

  • Select random elements $s',s\in \mathbb {Z}_{p}$ and let $g_{1}=g^{s'}$ and $g_{2}=g^{s}$ . Here let $\mathbb {M} \subset \mathbb {G}$ be the message space and $\mathbb {C} \subset \mathbb {G}^{4} \times \{0,1\}^{l_{1}+l_{2}}$ be the ciphertext space. The public system parameters are $K_{\mathrm {IBEET}}=(p,\mathbb {G},\mathbb {G}_{\mathrm {T}},e,g,g_{1},\,\,g_{2},\,\,H_{1}, H_{2},H_{3})$ . The master key $msk$ is $(s',s) \in \mathbb {Z}_{p}^{2}$ .

• Extract: On input an identity $ID \in \{0,1\}^{*}$ , it works as follows:

  • Firstly calculate $h_{ID}=H_{1}(ID)\in \mathbb {G}$ , and then calculate $sk_{ID}=(h^{s'}_{ID},h^{s}_{ID})$ as the private key, where $(s',s)$ is the master key.

• Trapdoor: On input an identity $ID \in \{0,1\}^{*}$ , it works as follows:

  • Firstly calculate $h_{ID}=H_{1}(ID)\in \mathbb {G}$ , then set the trapdoor $td_{ID}=h^{s'}_{ID}$ , which is the first element of $sk_{ID}$ .

• Enc: On input a message $M \in \mathbb {G}$ and an identity $ID$ , it works as follows:

  • Firstly calculate $h_{ID}=H_{1}(ID)\in \mathbb {G}$ , and randomly pick three elements $r_{1},r_{2},r_{3}\in \mathbb {Z}_{p}$ ;

  • Set the ciphertext to be $C=(C_{1},C_{2},C_{3},C_{4},C_{5})$ , where \begin{align*} C_{1}=&g^{r_{1}},\quad C_{2}=g^{r_{2}},~C_{4}=g^{r_{3}}, \\ C_{3}=&M^{r_{1}}H_{2}(U_{1}^{r_{2}}),\quad C_{5}=(M||r_{1})\oplus H_{3}(U_{2}^{r_{3}}),\end{align*} and where \begin{equation*} U_{1}=e(h_{ID},g_{1})\in \mathbb {G}_{\mathrm {T}},\quad U_{2} = e(h_{ID},g_{2})\in \mathbb {G}_{\mathrm {T}}.\end{equation*}

• Dec($C,sk_{ID}$ ): On input ciphertext $C$ and the private key $sk_{ID}=(h^{s'}_{ID},h^{s}_{ID})$ , where $C=(C_{1},C_{2},C_{3},C_{4},C_{5})\in \mathbb {C}$ is a ciphertext encrypted by using the identity $ID$ , the algorithm firstly calculates \begin{equation*} C_{5} \oplus H_{3}(e(h_{ID}^{s},C_{4}))=M||r_{1},\end{equation*} and then it outputs $M$ if the following equalities hold.\begin{equation*} C_{1}=g^{r_{1}},\frac {C_{3}}{M^{r_{1}}}=H_{2}(e(h_{ID}^{s'},C_{2}))\end{equation*} Otherwise, it outputs $``\bot ''$ .

• Test($C_{A},td_{ID_{A}},C_{B},td_{ID_{B}}$ ): On input ciphertexts $C_{A},~C_{B}$ and corresponding trapdoors $td_{ID_{A}},~td_{ID_{B}}$ respectively, to determine whether plaintexts $M_{A}$ and $M_{B}$ are equal or not, where \begin{equation*} C_{A}=(C_{A,1},C_{A,2},C_{A,3},C_{A,4},C_{A,5})=\mathrm {Enc}(M_{A},ID_{A})\end{equation*} and \begin{equation*} C_{B}=(C_{B,1},C_{B,2},C_{B,3},C_{B,4},C_{A,5})=\mathrm {Enc}(M_{B},ID_{B}),\end{equation*} $td_{ID_{A}}=h^{s'}_{ID_{A}}$ and $td_{ID_{B}}=h^{s'}_{ID_{B}}$ . It firstly computes:\begin{equation*} X_{A}=\frac {C_{A,3}}{H_{2}(e(h^{s'}_{ID_{A}},C_{A,2}))}, \quad X_{B}=\frac {C_{B,3}}{H_{2}(e(h^{s'}_{ID_{B}},C_{B,2}))},\end{equation*} and then it outputs “1” if the equation \begin{equation*} e(C_{A,1},X_{B})=e(C_{B,1},X_{A})\end{equation*} holds; otherwise it outputs “0”.

2) Insecurity of Ma’s Scheme

Next, we will show that the IBEET scheme doesn’t satisfy the above OW-ID-CCA security, which was firstly defined in paper [11]. From the definition of the OW-ID-CCA attack, at any time any adversary can have access to the trapdoor oracle to obtain the trapdoor of any identity including the challenge identity $ID^{*}$ . That is to say, at least the adversary can get $td_{ID^{*}}=h^{s'}_{ID^{*}}$ before guess stage in the attack game. When the adversary knows the challenge identity $ID^{*}$ and the challenge ciphertext $C^{*}=(C_{1}^{*},C_{2}^{*},C_{3}^{*},C_{4}^{*},C_{5}^{*})$ , it conducts as follows.

• When the adversary obtains the challenge $(ID^{*}, C^{*})$ , she/he checks whether the challenge identity $ID^{*}$ is listed in trapdoor queries or not. It can get $td_{ID^{*}}=h^{s'}_{ID^{*}}$ by having access to the trapdoor queries before the guess stage if it is not listed in previous trapdoor queries (A better and easier way to do it is to pick the challenge identity from the list of trapdoor queries in the phase 1. Because the challenge identity is chosen by the adversary.).

• Secondly, the adversary calculates \begin{equation*} V^{*}=\frac {C_{3}^{*}}{H_{2}(e(h_{ID^{*}}^{s'},C_{2}^{*}))},\end{equation*} and randomly selects $r \in \mathbb {Z}_{p}^{*}$ to set $C_{2}= (C_{2}^{*})^{r}$ . The adversary checks whether $C_{2}$ is a part of a ciphertext having been on the list of decryption queries and encrypted by the identity $ID^{*}$ . If it is on the list of decryption queries, then repeats above step (renew the random number $r$ ); otherwise, the adversary calculates \begin{equation*} C_{3} = V^{*}H_{2}(e(h_{ID^{*}}^{s'},(C_{2}^{*})^{r})).\end{equation*}

• Thirdly, the adversary modifies the challenge ciphertext $C^{*}$ and continues to perform the chosen ciphertext attack as follows. The adversary firstly sets \begin{align*} C_{1}'=&C_{1}^{*},\quad C_{2}'= C_{2},~C_{3}'=C_{3}, \\ C_{4}'=&C_{4}^{*},\quad C_{5}'=C_{5}^{*},\end{align*} and then submits $C'=(C_{1}',C_{2}',C_{3}',C_{4}',C_{5}')\,\,C'=(C_{1}',C_{2}',C_{3}',C_{4}',C_{5}')$ with the identity $ID^{*}$ to the decryption queries as a ciphertext. The challenge responds $M'$ if the “ciphertext” $C'$ is a valid ciphertext; otherwise it responds $``\bot ''$ .

• Finally, the adversary outputs $M^{*}(=M')$ as a plaintext of the challenge ciphertext $C^{*}$ and the challenge identity $ID^{*}$ .

For above attack, the ciphertext $C'$ doesn’t equal $C^{*}$ , because \begin{equation*} C_{2}'= C_{2}= (C_{2}^{*})^{r} \neq C_{2}^{*}.\end{equation*} When the decryption oracle receives $(ID^{*}, C')$ as a decryption query, it computes as follows.\begin{equation*} C'_{5} \oplus H_{3}(e(h_{ID^{*}}^{s},C'_{4}))=M'||r_{1}'.\end{equation*} Since $C^{*}$ is a valid ciphertext and $C_{1}'=C_{1}^{*},\,\,C_{4}'=C_{4}^{*},\,\,C_{5}'=C_{5}^{*}$ . We have $r_{1}'=r_{1}^{*}$ and $M'=M^{*}$ . And it is obvious that the following two equalities hold.\begin{align*} C_{1}'=&g^{r_{1}'}\quad \mathrm {and} \\ \frac {C'_{3}}{M'^{r'_{1}}}=&\frac {\frac {C_{3}^{*}}{H_{2}(e(h_{ID^{*}}^{s'},C_{2}^{*}))}H_{2}(e(h_{ID^{*}}^{s'},(C_{2}^{*})^{r}))}{M'^{r'_{1}}} \\=&H_{2}(e(h_{ID^{*}}^{s'},C'_{2})).\end{align*} Thus, the above adversary can successfully get $M'(=M^{*})$ , which is the plaintext of the challenge ciphertext $C^{*}$ .

Therefore, the IBEET scheme is not OW-ID-CCA secure.

D. Reason of Insecurity

Now, we analyse the IBEET scheme and find out the reason why it is insecure as follows. Firstly, from the construction of the encryption algorithm in the IBEET scheme, it is easy to find out that it encrypts $(M,r_{1})$ and $M^{r_{1}}$ respectively by independently using Boneh and Franklin’s identity-based encryption(IBE) scheme [19]. In detail, an encrypter picks a random number $r_{3} \in \mathbb {Z}_{p}$ to encrypt $(M,r_{1})$ and sets $C_{4}=g^{r_{3}},\,\,C_{5}=(M||r_{1})\oplus H_{3}(U_{2}^{r_{3}})$ as a corresponding ciphertext, and picks a random number $r_{2} \in \mathbb {Z}_{p}$ to encrypt $M^{r_{1}}$ and sets $C_{2}=g^{r_{2}},\,\,C_{3}=M^{r_{1}}H_{2}(U_{1}^{r_{2}})$ as a corresponding ciphertext. These two parts can independently be done and set as a ciphertext of $M$ . Thus, it is possible to make an adversary tamper the ciphertext.

Secondly, the IBEET scheme is a special IBE scheme, which needs to delegate the trapdoor to perform the test algorithm in the cloud server. So the value of $M^{r_{1}}$ can be known by the adversary after revealing the trapdoor. Thus the adversary can tamper the ciphertext after finding out $M^{r_{1}}$ .

Finally, we explain that why the above scheme is not secure but security can have been proved. Because there is an obvious gap between views of two adversaries in the IBEET scheme and “PUBK” scheme in [11], but which was not considered in their paper. Since the adversary in IBEET scheme can obtain $trapdoor$ and calculate $M^{r_{1}}$ ($= \frac {C_{4}}{\cdot }$ ), the adversary can change $C_{2}$ (but not necessary to know the exponent of $C_{2}$ ) and $C_{3}$ to construct a new valid ciphertext. However, the adversary in “PUBK” scheme hasn’t this capability. Because there does not exist a trapdoor algorithm to delegate the trapdoor information in the scheme. Therefore, the IBEET scheme is not secure, even security of “PUBK” scheme can be reduced to BDH problem in paper [11].

E. Further Consideration

From the above analysis, we advise to set $r_{2}=r_{3}$ , that will lead it to be difficult to tamper the ciphertext. Because if we want to construct a new ciphertext from $M^{r_{1}}$ , we will know $C_{5}$ of the original ciphertext and the input of hash function $H_{3}$ in $C_{5}$ . However, that needs to solve the hard problem BDH. On the other hand, when we formally prove the security of our idea, we should modify the encryption algorithm in “PUBK” scheme such that $C_{3} = M^{r_{1}}$ . That should be able to make adversaries in the IBEET scheme and “PUBK” scheme get the same views. The improvement can be proved by using the idea of Boneh and Franklin [19]. Because we use their scheme to encrypt $(M,r_{1})$ and $M^{r_{1}}$ with the same random element $r_{2}$ , respectively.

SECTION IV. Security Analysis of a CP-ABEET Scheme

Here, we first recall the notion of CP-ABEET and its security model. And then we review CP-ABEET scheme proposed by Wang et al. [16] and analyze its security.

A. Model of CP-ABEET and its Security Model

A CP-ABEET scheme includes six algorithms: Setup, KeyGen, Enc, Trapdoor, Dec and Test. The detailed is described as follows.

• Setup. Take a security parameter $k$ as input, and generate a master key $MSK$ and the public parameter $Param$ . And keep $MSK$ secure.

• KeyGen. Take as input the public parameter $Param$ , the master key $MSK$ and an attribute set $AL$ . Generate the secret key $SK$ for the attribute set $W$ .

• Enc. Take as input $Param$ , a plaintext message $M$ and an access structure $W$ . Generate a ciphertext $CT$ .

• Trapdoor. Take as input the public parameter $Param$ , an attribute set $AL$ , an access structure $T'$ and $MSK$ , generate the trapdoor $TD$ for users.

• Dec. Take as input the ciphertext $CT$ , the secret key $SK$ , generate the corresponding plaintext $M$ of the ciphertext $CT$ .

• Test. Take as input two ciphertexts $CT_{A},~CT_{B}$ , two trapdoors $TD_{A},~TD_{B}$ , it outputs 1 if the corresponding plaintext of $CT_{A}$ and $CT_{B}$ are the same messages; otherwise, it outputs 0.

Here, we review the definition of the security property defined in Wang et al.’s paper as follows [16].

$GAME~2$ . Let $\mathcal {A}$ be an adversary which interacts with a challenger $\mathcal {C}.~\mathcal {A}$ firstly chooses an access structure $W$ which it wishes to be challenged.

1. Setup. The challenger $\mathcal {C}$ takes as input a security parameter $k$ , and outputs the public parameter $Param$ and sends it to $\mathcal {A}$ .

2. Phase 1. $\mathcal {A}$ runs the following queries polynomially many times.

   • Key retrieve queries: The adversary $\mathcal {A}$ runs queries of the private keys of a set of attributes $AL$ for many access structures $T_{i}.~\mathcal {C}$ sends the corresponding private key $SK$ to $\mathcal {A}$ .

   • Trapdoor queries: $\mathcal {C}$ runs the Trapdoor algorithm and outputs the trapdoor $TD$ and responds to $\mathcal {A}$ .

3. Challenge: The adversary $\mathcal {A}$ selects two messages $M_{0}$ and $M_{1}$ with equal length and sends them to $\mathcal {C}.~\mathcal {C}$ uniformly selects a random bit $b \in \{0,1\}$ , and computes $CT^{*}$ = Encrypt($Param,W,M_{b}$ ) as a challenge, where $W$ is an access structure.

4. Phase 2: Phase 1 is repeated. The only constraint is that $AL$ which satisfies the access structure $W$ does not appear in the key retrieve queries.

5. Guess: $\mathcal {A}$ outputs a bit $b'$ .

The adversary $\mathcal {A}$ wins the game if $b = b'$ . The advantage of $\mathcal {A}$ is defined as $|\mathrm {Pr}[b = b']-\frac {1}{2}|$ .

Definition 4:

The CP-ABEET scheme is selectively IND-CPA secure if the advantage of any polynomial-time adversary is negligible in security parameter $k$ in the above game.

Note 1: The definition in the paper [16] required that the challenger $\mathcal {C}$ could answer the key retrieve queries for AL of any access structure. That definition is too strong such that there is no scheme satisfying that definition. Because if the adversary can obtain the secret key of AL satisfying the challenge access structure $W$ , then it can decrypt the challenge ciphertext $CT^{*}$ , and it can win the game with probability 1.

B. Recall the CP-ABEET Scheme and its Security Analysis

We recall the CP-ABEET scheme proposed by Wang et al. [16]. Wang et al. had shown that their scheme satisfies IND-CPA security. However, we will show that this security property doesn’t hold.

1) Recall the CP-ABEET Scheme

• Setup($1^{k})$ : On input a security parameter $k$ , produce $Param$ and the master key $MSK$ as follows.

  • Generate two bilinear groups $\mathbb {G},\mathbb {G}_{\mathrm {T}}$ with the same prime order $p$ , and generate a random generator $g \in \mathbb {G}$ . A map $e: \mathbb {G} \times \mathbb {G} \rightarrow \mathbb {G}_{\mathrm {T}}$ is a bilinear map.

  • Select two hash functions $H_{1}: \mathbb {G}_{\mathrm {T}} \rightarrow \mathbb {G} \times \mathbb {Z}_{p},\,\,H_{2}: \mathbb {G}_{\mathrm {T}} \rightarrow \mathbb {G}$ .

  • Randomly choose $N$ elements $r_{1}, \cdots, r_{N} \in \mathbb {Z}_{p}$ and calculate $R_{i} = g^{r_{i}}$ for $i= 1$ to $N$ . Where $N$ is the number of system attributes.

  • Randomly choose $\alpha, \alpha ', \gamma _{1}, \gamma _{2}, \gamma _{3} \in \mathbb {Z}_{p}$ and $W_{1},W_{2} \in \mathbb {G}$ and calculate \begin{align*} u_{1}=&e(g,W_{2})^{\alpha \gamma _{1}}e(g,W_{1})^{\alpha \gamma _{1}}, \\ v_{1}=&e(g,W_{2})^{\alpha \gamma _{2}}e(g,W_{1})^{\alpha \gamma _{2}}, \\ u_{2}=&e(g,W_{2})^{\alpha '\gamma _{1}}e(g,W_{1})^{\alpha '\gamma _{1}}, \\ v_{2}=&e(g,W_{2})^{\alpha '\gamma _{3}}e(g,W_{1})^{\alpha '\gamma _{3}}.\end{align*}

  • Set the public parameter $Param = (\mathbb {G},\,\,\mathbb {G}_{\mathrm {T}},\,\,g,\,\,p,\,\,e,\,\,g^{\alpha },\,\,g^{\alpha '},\,\,W_{1},\,\,W_{2},\,\,u_{1},\,\,u_{2},\,\,v_{1},\,\,v_{2},\,\,R_{1},\,\,\cdots,\,\,R_{N},\,\,H_{1},\,\,H_{2})$ and keep the master key $MSK = (\alpha,~\alpha ',~r_{1},~\cdots,~r_{N},~\gamma _{1},~\gamma _{2},~\gamma _{3})$ secret.

• Enc(M, Param, S, S’): On input a message $M$ , public parameter $Param$ and an access policy $W$ , which contains: $l_{1} \leq L_{1}$ wildcards occur at positions $J = \{\omega _{1},\cdots, \omega _{l_{1}}\},\,\,l_{2} \leq L_{2}$ positive attributes occur at positions $X = \{x_{1},\cdots, x_{l_{2}}\}$ , and $l_{3} \leq L_{3}$ negative attributes occur at positions $Y = \{y_{1},\cdots, y_{l_{3}}\}$ . By means of the Viéte’s formulas, for the wildcard position $\{\omega _{k}\}_{1, \cdots, l_{1}}$ in access structure, compute $a_{\omega _{k}}$ and set $t_{\omega } = \sum _{k=0}^{l_{1}}a_{\omega _{k}}$ . This algorithm creates the cipheretext $CT$ as follows.

  • Randomly pick $z, z_{1}, z_{2}, \in \mathbb {Z}_{p}$ and calculate \begin{align*} C_{0}=&H_{1}(u_{1}^{z_{1}}v_{1}^{z_{2}}) \oplus M\|z,\quad C_{1} = M^{z} H_{2}(u_{2}^{z_{1}}v_{2}^{z_{2}}), \\[-3pt] C_{2}=&g^{\frac {\alpha z_{1}}{t_{\omega }}},\quad C_{3} = g^{\frac {z_{2}}{t_{\omega }}},~C'_{2} = g^{\frac {\alpha ' z_{1}}{t_{\omega }}},~C'_{3} = g^{z}, \\[-3pt] C_{4}=&\left({W_{1} \prod _{i \in X}R_{i}^{\frac {\prod _{k=0}^{l_{1}}(i-\omega _{k})}{t_{\omega }}}}\right)^{z_{1}+z_{2}}, \\[-6pt] C_{5}=&\left({W_{2} \prod _{i \in Y}R_{i}^{\frac {\prod _{k=0}^{l_{1}}(i-\omega _{k})}{t_{\omega }}}}\right)^{z_{1}+z_{2}}.\end{align*}

  • Set $CT =(C_{0},C_{1},C_{2},C_{3},C_{4},C_{5},C'_{2},C'_{3},J)$ as the ciphertext.

• KeyGen(Param, MSK, AL): On input the public parameter $Param$ , the master key $MSK$ and a set of attributes $AL$ which contains: $l_{2} (\leq L_{2})$ positive attributes appear at positions $X = \{x'_{1}, \cdots, x'_{l_{2}}\},\,\,l_{3} \leq L_{3}$ negative attributes appear at positions $Y' = (y'_{1}, \cdots, y'_{l_{3}}\}$ . By means of the Viète’s formula, for all positive positions $\{x'_{i}\}_{i \in \{1, \cdots, l_{2}\}}$ and negative positions $\{y'_{i}\}_{i \in \{1, \cdots, l_{3}\}}$ , compute $\{a_{x'_{i}}\},~\{a_{y'_{i}}\}$ and set $t'_{x} = \sum _{k=0}^{l_{2}}a_{x'},\,\,t'_{y} = \sum _{k=0}^{l_{3}}a_{y'}$ . This algorithm produces the decryption secret key SK as follows:

  • Select a random element $s \in \mathbb {Z}_{p}$ , calculate $s_{1} = \gamma _{1} + s,\,\,s_{2} = \gamma _{2} + s,\,\,s_{3} = \gamma _{3} + s$ and generate the decryption secret key as follows.\begin{align*} sk_{1}=&g^{\frac {\alpha s}{t'_{x}}}, \quad sk_{2} = g^{\frac {\alpha s}{t'_{y}}}, ~sk'_{1} = g^{\frac {\alpha ' s}{t'_{x}}}, ~sk'_{2} = g^{\frac {\alpha ' s}{t'_{y}}}, \\[-4pt] sk_{3}=&\{sk_{3,0},sk_{3,1},\cdots, sk_{3,L_{1}}\},\end{align*} where $sk_{3,i} = W_{1}^{s_{1}}\prod _{j \in X'}g^{sr_{j}j^{i}},\,\,i$ from 0 to $L_{1}$ ;\begin{equation*} sk'_{3} = \{sk'_{3,0},sk'_{3,1},\cdots, sk'_{3,L_{1}}\},\end{equation*} where $sk'_{3,i} = W_{1}^{\alpha s_{2}}\prod _{j \in X'}g^{\alpha sr_{j}j^{i}},\,\,i$ from 0 to $L_{1}$ ;\begin{equation*} sk''_{3} = \{sk''_{3,0},sk''_{3,1},\cdots, sk''_{3,L_{1}}\},\end{equation*} where $sk''_{3,i} = W_{1}^{\alpha ' s_{3}}\prod _{j \in X'}g^{\alpha ' sr_{j}j^{i}},\,\,i$ from 0 to $L_{1}$ ;\begin{equation*} sk_{4} = \{sk_{4,0},sk_{4,1},\cdots, sk_{4,L_{1}}\},\end{equation*} where $sk_{4,i} = W_{2}^{s_{1}}\prod _{j \in Y'}g^{sr_{j}j^{i}},\,\,i$ from 0 to $L_{1}$ ;\begin{equation*} sk'_{4} = \{sk'_{4,0},sk'_{4,1},\cdots, sk'_{4,L_{1}}\},\end{equation*} where $sk'_{4,i} = W_{2}^{\alpha s_{2}}\prod _{j \in Y'}g^{\alpha sr_{j}j^{i}},\,\,i$ from 0 to $L_{1}$ ;\begin{equation*} sk''_{4} = \{sk''_{4,0},sk''_{4,1},\cdots, sk''_{4,L_{1}}\},\end{equation*} where $sk''_{4,i} = W_{2}^{\alpha ' s_{3}}\prod _{j \in Y'}g^{\alpha ' sr_{j}j^{i}},\,\,i$ from 0 to $L_{1}$ . Set $SK = (sk_{1},sk_{2},sk'_{1},sk'_{2},sk_{3},sk'_{3},sk''_{3},sk_{4},sk'_{4},sk''_{4})$ as the decryption key.

• Trapdoor($Param, AL, SK$ ): On input the public parameter $Param$ , a set of attributes $AL$ and the decryption secret key $SK$ , output a trapdoor $TD = $ \begin{equation*} (td_{1}, td_{2},(td_{3,i},td'_{3,i},td_{4,i},td'_{4,i})_{i \in [{0,L_{1}}]}),\end{equation*} where $td_{1} = sk'_{1},\,\,td_{2}\,\,td_{3,i} = sk_{3,i},\,\,td'_{3,i} = sk''_{3,i},\,\,td_{4,i} = sk_{4,i},\,\,td'_{4,i} = sk''_{4,i}$ , for $i= 0$ to $L_{1}$ .

• Dec($CT,SK, S,S'$ ): On input the ciphertext $CT$ and the decryption secret key $SK$ , compute the plaintext as follows.\begin{align*} V_{1}=&\frac {e\left({\prod _{j=1}^{l_{1}}sk_{3,j}^{a_{\omega _{j}}},C_{2}}\right) e\left({\prod _{j=1}^{l_{1}}(sk'_{3,j})^{a_{\omega _{j}}},C_{3}}\right)}{e(sk_{1},C_{4})^{t_{x'}}} \\&\times \frac {e\left({\prod _{j=1}^{l_{1}}sk_{4,j}^{a_{\omega _{j}}},C_{2}}\right)e\left({\prod _{j=1}^{l_{1}}(sk'_{4,j})^{a_{\omega _{j}}},C_{3}}\right)}{e(sk_{2},C_{5})^{t_{y'}}}, \\ V_{2}=&\frac {e\left({\prod _{j=1}^{l_{1}}sk_{3,j}^{a_{\omega _{j}}},C'_{2}}\right) e\left({\prod _{j=1}^{l_{1}}(sk''_{3,j})^{a_{\omega _{j}}},C_{3}}\right)}{e(sk'_{1},C_{4})^{t_{x'}}} \\&\times \frac {e\left({\prod _{j=1}^{l_{1}}sk_{4,j}^{a_{\omega _{j}}},C_{2}}\right)e\left({\prod _{j=1}^{l_{1}}(sk''_{4,j})^{a_{\omega _{j}}},C_{3}}\right)}{e(sk'_{2},C_{5})^{t_{y'}}}, \\ M\|z=&H_{1}(V_{1})\oplus C_{0}.\end{align*} If $C'_{3}= g^{z}$ and $H_{2}(V_{2}) = \frac {C_{1}}{M^{z}}$ , then output the plaintext $M$ . Here all $a_{k}$ above are coefficients in the unfolding polynomial $\prod _{k=0}^{l_{1}}(i-\omega _{k})$ .

• Test$(CT_{A}, CT_{B}, TD_{A}, TD_{B}, S')$ : On input two ciphertexts $CT_{A},~CT_{B}$ and the corresponding trapdoors $TD_{A},~TD_{B}$ , respectively. This algorithm decides that the planitexts $M_{A}$ and $M_{B}$ are equal or not as follows.

  Compute \begin{align*} Q'_{A}=&\frac {e\left({\prod _{j=1}^{l_{1}}td_{3,j,A}^{a_{\omega _{j},A}},C'_{2,A}}\right)e\left({\prod _{j=1}^{l_{1}}(td'_{3,j,A})^{a_{\omega _{j},A}},C_{3,A}}\right)}{e(td_{1,A},C_{4,A})^{t_{x'_{A}}}} \\&\times \frac {e\left({\prod _{j=1}^{l_{1}}td_{4,j,A}^{a_{\omega _{j},A}},C'_{2,A}}\right)e\left({\prod _{j=1}^{l_{1}}\!(td'_{4,j,A}) ^{a_{\omega _{j},A}},\!C_{3,A}}\right)}{e(td_{2,A},C_{5,A})^{t_{y'_{A}}}}, \\ Q_{A}=&\frac {C_{1,A}}{H_{2}(Q'_{A})}. \\ Q'_{B}=&\frac {e\left({\prod _{j=1}^{l_{1}}td_{3,j,B}^{a_{\omega _{j},B}},C'_{2,B}}\right)e\left({\prod _{j=1}^{l_{1}}(td'_{3,j,B})^{a_{\omega _{j},B}},C_{3,B}}\right)}{e(td_{1,B},C_{4,B})^{t_{x'_{B}}}} \\&\times \frac {e\left({\prod _{j=1}^{l_{1}}td_{4,j,B}^{a_{\omega _{j},B}},C'_{2,B}}\right) e\left({\prod _{j=1}^{l_{1}}\!(td'_{4,j,B})^{a_{\omega _{j},B}},\!C_{3,B}}\right)}{e(td_{2,B},C_{5,B})^{t_{y'_{B}}}}, \\ Q_{B}=&\frac {C_{1,B}}{H_{2}(Q'_{B})}.\end{align*} and if $e(Q_{B},C'_{3,A}) = e(Q_{A},C'_{3,B})$ it outputs 1; Otherwise, it outputs 0.

2) The CP-ABEET Scheme ISN’t Secure for IND-CPA

Now, we analyze the IND-CPA security of the CP-ABEET scheme.

From the definition of $GAME~2$ , we know that any adversary $\mathcal {A}$ selects the challenge messages $M_{0}$ and $M_{1}$ and obtains the challenge ciphertext $CT^{*}$ which is a ciphertext of $M_{0}$ or $M_{1}$ . Next, the adversary $\mathcal {A}$ continues to make trapdoor query get the trapdoor $TD$ of the attribute set $AL$ satisfying the access structure $W$ . This is important to our attack. The adversary uses $TD$ and $CT^{*}$ to compute \begin{align*}&\hspace {-1pc}V= \frac {e\left({\prod _{j=1}^{l_{1}}sk_{3,j}^{a_{\omega _{j}}},C'_{2}}\right)e\left({\prod _{j=1}^{l_{1}}(sk''_{3,j})^{a_{\omega _{j}}},C_{3}}\right)}{e(sk'_{1},C_{4})^{t_{x'}}} \\&\qquad \qquad \qquad \quad \times \frac {e\left({\prod _{j=1}^{l_{1}}sk_{4,j}^{a_{\omega _{j}}},C_{2}}\right)e\left({\prod _{j=1}^{l_{1}}(sk''_{4,j})^{a_{\omega _{j}}},C_{3}}\right)}{e(sk'_{2},C_{5})^{t_{y'}}},\end{align*} and \begin{equation*} X_{M_{b}} = \frac {C_{1}}{H_{2}(V)}.\end{equation*} Then, the adversary verifies the following equality.\begin{equation*} e(X_{M_{b}}, g) \stackrel {?}{=} e(M_{0}, C'_{3})\end{equation*} If the equality holds, the adversary outputs $M_{0}$ ; otherwise, it outputs $M_{1}$ .

Obviously, if the challenge ciphertext $CT^{*}$ is a valid ciphertext and the trapdoor $TD$ is valid, then the value of $V$ is correct and such that \begin{equation*} M_{b}^{z} = X_{M_{b}} = \frac {C_{1}}{H_{2}(V)}.\end{equation*}

Since \begin{equation*} e(X_{M_{b}}, g) = e(M_{b}^{z}, g) = e(M_{b}, g^{z}),\end{equation*} while \begin{equation*} e(M_{0}, C'_{3})= e(M_{0}, g^{z}).\end{equation*} Thus, the equality $e(X_{M_{b}}, g) = e(M_{0}, C'_{3})$ holding means $M_{b} = M_{0}$ ; otherwise, it means $M_{b} = M_{1}$ .

Thus, the attack can show that the CP-ABEET scheme isn’t IND-CPA secure.

C. Brief Summary and Future Work

Wang et al. wanted to construct a CP-ABEET scheme which is IND-CPA secure without random oracle. However, they omitted the adversary can access to the trapdoor oracle to get the trapdoor of any attribute set, which can be used to the Test algorithm. Furthermore, the adversary can choose a message $M_{b}$ from $\{M_{0},M_{1}\}$ to get a ciphertext $CT'$ and use the Test algorithm to output $M_{b}$ is $M_{0}$ or $M_{1}$ . If we only want to construct a CP-ABEET scheme which is IND-CPA secure in random oracle model, we can add some hash functions to construct a secure CP-ABEET scheme. However, to construct an IND-CPA secure CP-ABEET in the standard model is not easy. This is our future work.

SECTION V. Conclusion

IBEET and ABEET are important cryptographic schemes to solve the searching encrypted data in cloud computing. They not only have the functionality of decryption, but also can compare the ciphertexts to determine whether the corresponding plaintexts are the same or not. However, some of the constructions have been omitted that the adversary could get the trapdoors in their security models, and that caused the schemes to be not secure. We analyzed the security of two schemes in this paper. We firstly proved that the IBEET scheme wasn’t one-way under chosen ciphertext attack and gave some idea to improve the scheme. Then we proved that the CP-ABEET scheme wasn’t indistinguishable against chosen plaintext attack in the standard model.