ABE ⇒ BE

Fully-black-box reduction · standard model · folklore · security loss: none (the reduction preserves the advantage)

Statement

Take a CP-ABE scheme over attribute universe $[n]$ whose policy class contains disjunctions. Give user $i$ the ABE key for the singleton attribute set $\{i\}$, and encrypt to $S\subseteq [n]$ under the policy $f_S(x)=[x\cap S\ne \varnothing ]$, the disjunction of the attributes in $S$, so $f_S(\{i\})=[i\in S]$. If the scheme is CP-IND-CPA-secure, the resulting BE for $n$ users is IND-BE-CPA-secure: every BE adversary is verbatim a CP-ABE adversary with the same advantage — folklore.

Sketch

The BE relation $i\in S$ is the CP-ABE relation $f_S(\{i\})=1$, so BE admissibility (no key for $i\in S^{\ast }$) is CP-ABE admissibility (no queried attribute set satisfies $f_{S^{\ast }}$).

Notes

• The resulting BE has no ciphertext-size guarantee: its ciphertext is a CP-ABE ciphertext for a policy of size $|S|$, so short BE ciphertexts need CP-ABE with ciphertexts succinct in the policy — folklore.