Attribute Based Encryption

Attribute Based Encryption

# Attribute-Based Encryption Toolkit

Design, encrypt, decrypt, and audit cryptographic access control policies using Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Key-Policy Attribute-Based Encryption (KP-ABE). Generate policy trees, simulate access attempts, validate key-attribute matches, and produce compliance-ready access reports — all from a CLI.

Traditional encryption is all-or-nothing. One key unlocks everything. In environments with dozens of roles, hundreds of users, and petabytes of data, this creates an impossible choice between security and usability. - Public-key encryption gives no access granularity beyond key possession - Symmetric encryption requires pre-sharing keys with every authorized party - Role-based access control (RBAC) is enforced at the application layer, not cryptographically - Data in shared storage (S3 buckets, cloud drives, data lakes) is vulnerable to insider threats When access control lives in the application layer, any bug, misconfiguration, or privilege escalation bypasses all protection. The data itself has no enforcement mechanism.

What It Does

• Define attribute-based access policies as logic trees (AND/OR gates, thresholds)
• Encrypt plaintext data under a policy — only matching attributes can decrypt
• Generate user secret keys bound to specific attribute sets
• Simulate decryption attempts to verify policy correctness
• Audit key-attribute assignments for compliance violations
• Convert policies to JSON, YAML, and CBOR for cross-platform use

Frameworks and Standards Covered

| Framework/Standard | Relevance | |---|---| | CP-ABE (Ciphertext-Policy ABE) | Data encrypted under policy; keys bound to attributes | | KP-ABE (Key-Policy ABE) | Keys bound to policies; data tagged with attributes | | NIST SP 800-175B | Cryptographic standards guidance | | FIPS 140-3 | Cryptographic module validation context | | OASIS XACML | Attribute-based access control architecture | | NISTIR 8214 | Attribute-based security concepts | | ISO/IEC 27001 | Information security management interface | | Zero Trust Architecture (NIST SP 800-207) | ABE as a pillar for data-centric zero trust | | GDPR Article 32 | Data protection through encryption | | HIPAA Security Rule 164.312 | Access control and encryption of ePHI |

Detailed Feature Breakdown

### 1. Policy Definition Language Define access policies using a human-readable logic language. Each policy is a tree of attribute requirements combined with Boolean operators. ``` Policy: "senior AND (compliance OR legal)" OR +-- AND | +-- role=senior | +-- OR | +-- department=compliance | +-- department=legal +-- emergency=true ``` Supports: - AND gates (all children must match) - OR gates (any child must match) - k-of-n threshold gates (at least k of n children must match) - Attribute value comparisons (string equality, numeric range, regex) - Negation (attribute must NOT be present or must NOT match) ### 2. Encryption Engine Encrypts plaintext under an access policy. The ciphertext embeds the policy such that only keys satisfying the policy can decrypt. - Supports arbitrary plaintext (text, JSON, binary files) - Wraps data in authenticated encryption (AES-256-GCM) under the ABE-derived key - Attaches policy metadata to ciphertext header - Outputs portable ciphertext format (JSON with base64-encoded components) - Includes integrity verification tags ### 3. Key Generation Generate private (secret) keys bound to specific attribute sets from a master authority key. - Generate master authority key (setup) - Derive user keys for arbitrary attribute sets - Export keys in PEM and JSON formats - Support key rotation and revocation markers - Enforce attribute naming conventions ### 4. Decryption and Verification Decrypt ciphertext by matching a user's attributes against the embedded policy. If the attribute set satisfies the policy, decryption succeeds. - Strict matching: all policy conditions must be met - Partial match detection: report which attributes are missing - Decryption simulation without actual plaintext exposure - Batch decryption for multiple ciphertexts sharing a policy ### 5. Audit and Compliance Generate reports for audit and compliance verification. - List all keys and their attribute sets - Identify keys that can decrypt a given ciphertext - Detect attribute drift (keys with attributes no longer valid) - Produce compliance-ready reports in Markdown and JSON - Log all encryption and decryption events ### 6. Benchmarking Measure encryption and decryption performance. - Policy complexity vs. time benchmarks - Key size vs. time benchmarks - Attribute count vs. time benchmarks - Output machine-readable CSV results

Usage

### Quick Start ```bash # Generate master authority key abe setup --out ./authority/ # Create a policy abe policy create --name "executive-access" --file policy.yaml # Encrypt sensitive data under the policy abe encrypt --in secrets.json --out secrets.abe --policy executive-access --authority ./authority/ # Generate a user key for a senior compliance officer abe keygen --out ./keys/alice.key --attributes '{"role": "senior", "department": "compliance"}' --authority ./authority/ # Decrypt with the user's key abe decrypt --in secrets.abe --out secrets.decrypted --key ./keys/alice.key # Simulate decryption without data abe simulate --ciphertext secrets.abe --key ./keys/alice.key # Audit all keys against a policy abe audit --policy executive-access --keys-dir ./keys/ --report audit_report.md ``` ### Configuration Create a `config.yaml`: ```yaml abe: curve: BN256 kdf: argon2id cipher: aes-256-gcm authority_dir: ./authority/ keys_dir: ./keys/ output_dir: ./encrypted/ policy_dir: ./policies/ log_level: info audit_log: ./logs/abe_audit.log ``` ### Policy Definition ```yaml policy: name: clinical-trial-access description: Access control for clinical trial phase 3 data version: "2.1" root: operator: AND children: - attribute: role operator: IN values: [principal-investigator, clinical-data-manager, ethics-review] - attribute: clearance_level operator: GTE value: 3 - operator: OR children: - attribute: department operator: EQ value: oncology - attribute: trial_id operator: EQ value: CT-2026-047 - operator: AND children: - attribute: country operator: IN values: [US, UK, DE, FR, JP] - attribute: gdpr_trained operator: EQ value: "true" ```

Output Format

Encrypted ciphertext (JSON): ```json { "version": "1.0", "ciphertext": "AES-256-GCM encrypted payload (base64)", "policy_hash": "sha256:abc123def456", "policy_metadata": { "name": "clinical-trial-access", "version": "2.1" }, "tag": "base64-encoded-auth-tag", "iv": "base64-encoded-initialization-vector", "created_at": "2026-07-06T12:00:00Z" } ``` Audit report (Markdown): ```markdown # ABE Key Attribute Audit Report Generated: 2026-07-06 12:00:00 UTC Policy: clinical-trial-access

Key Inventory

| Key ID | Owner | Attributes | Compliant | |--------|-------|------------|-----------| | K-001 | Alice | role:pi, dept:oncology | YES | | K-002 | Bob | role:viewer, dept:admin | NO |

Non-Compliant Keys

K-002: Missing clearance_level >= 3, trial_id not matched ```

Why This Beats Prompting It Yourself

Prompting a Generic LLM This Toolkit --- --- --- Cryptographic correctness LLM may invent non-functional ABE algorithms Uses standard pairing-based crypto with verified primitives Policy consistency Manual, error-prone transcription Structured policy language with validation Performance measurement No benchmarking capability Built-in benchmark suite Key management Ad-hoc, no audit trail Key inventory with rotation tracking Compliance readiness No report generation Audit reports in Markdown/JSON Reproducibility Different output each time Deterministic encryption with provenance Reusability One-off interactions Reusable policies, keys, and configurations Cross-platform Prompt-only, no CLI CLI tool with JSON/YAML output for pipelines

Use Cases