Attribute-Based Encryption.

Attribute-Based Encryption (ABE) grew out of Amit Sahai and Brent Waters' 2005 Fuzzy Identity-Based Encryption paper (IACR ePrint 2004/086), which treated an identity as a set of descriptive attributes and allowed decryption when two attribute sets overlapped by a threshold. This error tolerance was designed for biometric identities but generalised into ABE, where policies replace fixed identities.

Two variants exist. In Key-Policy ABE (KP-ABE) the ciphertext carries attributes and the user's key encodes an access policy. In Ciphertext-Policy ABE (CP-ABE) — introduced by Bethencourt, Sahai, and Waters at the 2007 IEEE Symposium on Security and Privacy — the ciphertext carries a Boolean policy over attributes and each key carries the holder's attributes; the encryptor thus decides who may decrypt, much like role-based access control baked into the ciphertext itself. Decryption succeeds only when a key's attributes satisfy the ciphertext's policy tree.

ABE relies on bilinear pairings over curves such as BN254 or BLS12-381 and provides built-in collusion resistance: users cannot pool distinct keys to satisfy a policy none of them meets alone, because each key is randomised per user. Reference implementations include OpenABE (formerly the Zeutro/DARPA library) and the Charm-Crypto framework. Practical hurdles remain — attribute revocation, key escrow by the authority, and the cost of pairings — which multi-authority and outsourced-decryption schemes aim to address.

flowchart TD
  subgraph Setup
    A[Attribute Authority] -->|master key| A
    A -->|issues key for<br/>attributes: doctor, cardiology| U[User key]
  end
  E[Encryptor] -->|policy:<br/>doctor AND cardiology| C[Ciphertext + policy tree]
  C --> D{Do user's attributes<br/>satisfy the policy?}
  U --> D
  D -- Yes --> P[Plaintext recovered]
  D -- No --> X[Decryption fails]

Use cases include fine-grained access control for shared cloud storage, electronic health records, encrypted data lakes, and DRM where a single ciphertext serves many recipients without re-encryption per user.