Collusion Trap Against GVW’13 ABE

Attribute-based encryption has broad application prospects. GVW'13 attribute-based encryption (ABE) scheme is one of the major candidates for ABE. The scheme has exquisite structure and proven security, and the crucial component is two-to-one recoding (TOR) algorithm. However, it has security risks in practical applications. In this paper, we describe this security risk, the collusion trap against GVW'13 ABE. In such a scenario: Alice and Bob collude to share decryption ability. In other words, when anyone can decrypt the ciphertext, he will tell the other one the corresponding plaintext. If Bob decrypts Alice's fake ciphertext and returns “corresponding plaintext” to Alice, Alice can attempt to gradually calculate Bob's secret key. We use the method of chosen-ciphertext attack of Jaulmes and Joux against NTRU to construct our attack. We show that whether for naked encryption or for calibrated encryption, Alice can obtain the equivalent secret key of Bob in polynomial time, although the size of the attack for calibrated encryption is much larger.