Attribute Gate
Encrypt to a policy instead of to a person, test collusion resistance, split issuance across independent authorities, and see what an honest revocation overlay must still do.
Live demo · one of the browser demos in the Crypto Lab suite.
What It Is
Four deliberately separate browser lessons run over real BLS12-381 pairings. Exhibits 1–8 implement FAME — Fast Attribute-based Message Encryption, Shashank Agrawal and Melissa Chase, ACM CCS 2017 (ePrint 2017/807) — as public-policy ciphertext-policy attribute-based encryption. Exhibit 9 implements the CP-A2BE construction from FABESA — Long Meng, Liqun Chen, Yangguang Tian and Mark Manulis, ACM CCS 2024 (ePrint 2024/986) — as a bounded, partially hidden-policy lesson. Exhibit 10 independently implements the decentralized multi-authority CP-ABE construction of Yannis Rouselakis and Brent Waters, Financial Cryptography 2015 (paper; authors' asymmetric Charm implementation). Exhibit 11 is an application-layer epoch-gating and owner-assisted DEK-rewrap adaptation built around FAME; it is not part of RW15 and is not presented as a new revocable-ABE construction.
Ordinary public-key encryption addresses a person. Ciphertext-policy ABE addresses a rule: you encrypt under (Doctor AND Cardiology) OR Emergency, and whoever turns out to hold a satisfying set of attributes can decrypt. Nobody has to know in advance who that will be.
The security property that makes it more than a filing convention is collusion resistance: two people whose attributes only jointly satisfy the policy must not be able to pool their key material. Every ABE paper states this. This demo makes you do it — it splices two real keys into one, runs the genuine decryption on the result, and shows the exact term that refuses to cancel.
FABESA addresses a different question. Its partially hidden payload withholds attribute values, but deliberately publishes attribute names, the matrix, row map, structure, dimensions and lengths. The page compares two equal-public-payload worlds, performs the paper's candidate decryptions, and uses an AES-GCM tag—not an expected plaintext—as the bounded teaching wrapper's success oracle.
RW15 addresses the single-authority escrow boundary. Doctor@Hospital and Cardiology@Board are issued under independent master secrets, yet components for the same canonical global identifier combine. Components for two different identifiers can satisfy the public labels while recovering the wrong GT element; the record tag then rejects. Compromising one authority lets the adversary mint that authority's attributes for any identifier, but it does not mint the other authority's namespace.
The epoch lesson addresses a different lifecycle problem. A fresh epoch attribute is required in every new policy, a complete current-epoch FAME key is withheld from a revoked holder, and an owner who can recover the DEK replaces selected access headers without rewriting payload bytes. Saved old keys and headers still open saved old data, and replay is stopped only when a separately trusted checkpoint rejects the old header.
The exact primitives
| Layer | Primitive | Source |
|---|
| Public-policy ABE | FAME CP-ABE, linear-assumption parameter k = 2 | Agrawal & Chase, CCS 2017, Figure 3.1 |
| Hidden-value ABE | FABESA CP-A2BE, bounded one-value-per-name profile | Meng et al., CCS 2024, Figure 5 and §3.3 |
| Multi-authority ABE | RW15 large-universe decentralized CP-ABE | Rouselakis & Waters, FC 2015, §4.1 |
| Pairing | BLS12-381, Type-3: e : G1 × G2 → GT | @noble/curves v2 |
| Random oracles | Scheme-specific, versioned DSTs into G1 for FAME/FABESA and into G2 for RW15 | RFC 9380 |
| KDF | HKDF-SHA-256 | RFC 5869, via WebCrypto |
| AEAD | AES-256-GCM, 96-bit nonce, 128-bit tag | NIST SP 800-38D, via WebCrypto |
Setup, KeyGen, Encrypt and Decrypt for FAME, FABESA and RW15 are hand-written from their papers so they stay inspectable, along with the modular inverse, construction-specific access-tree → LSSS conversions, reconstruction and bounded FABESA candidate enumeration. Only the field/curve arithmetic and hash-to-curve are library code. The epoch lesson composes real FAME, HKDF and AES-GCM operations but makes no theorem claim for that composition.
Why FAME, and not the BSW07 scheme everybody cites
Bethencourt, Sahai and Waters (IEEE S&P 2007) is the access-tree construction most ABE explanations use, and it is cited here for exactly what it is: the origin of the access-tree formulation and of the collusion argument, in the symmetric-pairing setting it actually describes, e : G0 × G0 → GT.
BLS12-381 is Type-3 — e : G1 × G2 → GT, with no efficient isomorphism in either direction. Several BSW elements are required on both the key side and the ciphertext side, which is precisely where the symmetric assumption is load bearing, so transplanting BSW onto this curve and still calling it BSW07 would be a spec-fidelity claim the code could not support. FAME was designed for Type-3 from the start, is efficient, is large-universe, and removes the translation burden entirely. The collusion property is identical in both schemes — per-user key randomization is what blocks pooling either way — so nothing pedagogical is lost.
A documented Type-3 translation of BSW07 was considered and rejected: viable, but it obliges a proof of which elements land in G1 versus G2, which are published in both, and why the duplication does not break the security argument — for no pedagogical gain over FAME.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
