Cryptanalysis and Repair of "Decentralized Multi-authority ABE for NC$^1$ from BDH"

What it is

Xingwang Wang's ePrint 2026/2642 (preprint, approved 26 October 2026) breaks the DBDH-based and CBDH-based multi-authority attribute-based encryption (ABE) schemes of Datta, Komargodski and Waters (Journal of Cryptology, 2023), then gives a repair with static security proofs. It also attacks both multi-authority attribute-based inner-product functional encryption schemes of Datta and Pal (PKC 2023) and repairs them.

How it works

The original schemes rely on the LSSS matrix-normalization lemma from Rouselakis and Waters (FC 2015), extended to the multi-authority setting. The paper says this extension is invalid. Preserving the distribution of complete shares does not preserve the coordinate-wise ciphertext masks. A corrupt authority can expose those masks and use them to remove identity binding from other users' shares. Two users who are each unauthorized, even when given the corrupt authority's attribute, can then combine shares and recover the plaintext.

The repair replaces the coordinate-wise masks with independent full linear sharings of zero. The paper says this keeps correctness and restores ciphertext-distribution invariance.

Preconditions / Affected

• The attack needs one corrupt authority and two users. It succeeds with probability one in the claimed static security model.
• Affected: both the DBDH and CBDH variants of Datta-Komargodski-Waters, and both Datta-Pal multi-authority inner-product constructions (small-universe and large-universe).
• The paper does not say whether any deployed system uses these schemes.

What to do

If you rely on any of these constructions, treat their published security claims as void and move to the repaired versions.

• The repair keeps keys, decryption, ciphertext size, the original matrix-width restriction and the row-labeling restriction. Only encryption changes, needing extra randomness and finite-field arithmetic.
• Static security is proved in the random oracle model under the respective BDH assumptions. The CBDH variant uses the original hardcore-bit convention. The proofs allow adaptive identity-hash queries.
• The repaired Datta-Pal small-universe scheme is proved secure under asymmetric DBDH.
• For the large-universe Datta-Pal scheme, the paper says the original reduction is missing a source-group encoding. It gives a full static proof under an augmented L-DBDH assumption, and shows that assumption holds in the generic bilinear group model.

Caveats

• The result is a preprint with no peer review noted.
• The proofs cover static security only, and rely on the random oracle model.
• The large-universe scheme depends on a new augmented assumption, which is justified only in the generic group model.