Imagine that a department manager alice is away for

Imagine that a department manager, Alice, is away for vacation and she wants
to delegate Bob to process the received emails sent by Company E or Company
F. A number of emails with different attribute sets were sent to Alice during her
vacation. They contained ones sent by her friends, by hospitals, by some mag-
azine companies whose products Alice has subscribed to, and so on. They were
encrypted before transmitting in order to preserve the data’s privacy. For flexible
access control on decryption delegation, every encrypted email was associated
with certain attributes that can describe the corresponding ciphertext. Alice
specified a policy describing that only emails from Company E or Company F
can be handled by Bob. With this policy, her own secret key and Bob’s public
key, Alice generated by herself a re-encryption key from Alice to Bob. With a cor-
responding re-encryption key generated by Alice, the email server can transform
the ciphertexts satisfying the policy embedded in the re-encryption key into the
encrypted emails under Bob’s public key. Note that in a system with plain emails’
attributes, the email server might learn that Alice probably went to hospital to
take some disease testing, and what kinds of magazines that Alice was interested
in. The inference about Alice’s disease history might have an impact on her daily
life, and the magazine subscriptions may expose Alice’s hobby and disposition for
recreation. Additionally, it could possibly result in leaking some sensitive infor-
mation to some commercial cooperations, even though the complete and exact
content remains secret from the server (refer to Fig. 1 ). Obviously, this is not
the situation that Alice expects to be. These personal and sensitive data should

Anonymous Attribute-Based Conditional Proxy Re-encryption 97
be completely shrouded (i.e., guaranteeing payload-hiding and attribute-hiding
simultaneously).
Fig. 1. Attribute-based conditional proxy re-encryption
The above observations show the necessity of hiding ciphertexts’ attributes
from prying eyes in certain applications. Therefore, it motivates us to study
attribute-based conditional proxy re-encryption scheme (AB-CPRE) supporting
attribute-hiding in this paper.
1.1 Our Contributions
In this paper, we first modify the model of AB-CPRE in [ 32 ] to allow for
anonymity of the original ciphertexts. After describing the formal definition of
anonymous AB-CPRE, we construct a concrete anonymous AB-CPRE scheme
based on this new model. Finally, we prove our proposed scheme in the sense of
both security and anonymity, without relying on random oracles.
1.2 Related Work
In this section, we summarize the major related works in the areas of attribute-
based encryption and proxy re-encryption.
Attribute-Based Encryption. The notion of ABE was first introduced by Sahai
and Waters as an application of their fuzzy identity-based encryption (IBE)
scheme [ 25 ]. In such an ABE system, both ciphertexts and secret keys are asso-
ciated with attributes. The decryption on a ciphertext will succeed if and only
if the attribute set for the ciphertext and the one for the secret key overlap
by at least a fixed threshold value k . In 2006, Goyal et al. [ 14 ] formalized two
complimentary forms of ABE: KP-ABE and CP-ABE. In a CP-ABE scheme,
decryption keys are associated with attribute sets and ciphertexts are associ-
ated with access structures, while, in a KP-ABE, the situation is reversed (i.e.,