IPPE ⇒ Payload-only hiding

Fully-black-box reduction · standard model · folklore · security loss: tight (advantage preserved exactly)

Statement

Every attribute-hiding IPPE scheme is payload-hiding: for every efficient payload-hiding adversary there is an efficient attribute-hiding adversary with the same advantage — folklore.

Sketch

A payload-hiding adversary with challenge $(x^{\ast },m_0),(x^{\ast },m_1)$ is an admissible attribute-hiding adversary with $x_0=x_1=x^{\ast }$: $⟨v,x_0⟩=0\iff ⟨v,x_1⟩=0$ holds for every $v$, and the condition on messages is vacuous because no queried $v$ has $⟨v,x^{\ast }⟩=0$. The two games then coincide.

Notes

• Payload-hiding and attribute-hiding are defined in KSW08.