Hi All
Courtesy of Professor Bill Buchanan:
Telecoms Goes Post Quantum With Attribute-Based Encryption (ABE) As you may know, some telecoms industries are well behind the rest of the world in terms of cybersecurity, and the GSM network is often stuck with weak cryptography methods. But this is changing due to the threat of quantum computers. Just today, the European Telecommunications Standards Institute (ETSI) published a new framework which supports Key Encapsulation Mechanisms (KEMs). This standard defines a hybrid approach which supports pre-quantum and post-quantum methods — known as a hybrid approach. With this, the keys created will be encapsulated with user attributes, but where these attributes are anonymous. A user thus has to provide their attributes within the encapsulation policy, and it will retrieve the key. If a user cannot provide the correct attributes, these will not gain access to the target key. Obviously, some users could have the same attributes, such CTR (Country)=EN, DPT (Department=DEV) and SEC (Security)=LOW. For this, the scheme users a tracing facility in which a tracing authority can distinguish users with the same attributes. == Key Encapsulation Mechanisms (KEMs) == With KEMs, we can generate a session key and then protect it with the recipient's public key so that the private key can then be used to decrypt it. The approach used is a traditional public key method along with a post-quantum robust encapsulation, which defines the hybrid approach. Attribute-based Encryption is then used to define how the key can be recovered. If the attributes do not match, the key will not be recovered. In this way, a policy can be applied to reveal the session key. In the case of the new hybrid KEM, we use ciphertext-policy ABE (CP-ABE), and which provides good performance. The method is defined as KEMs with Access Control (KEMAC), and where keys are issued with a key policy (Y), and then where a session key is encapsulated with an encapsulation policy (X). The user can then only decapsulate the session key if R(X,Y)=1, and where R() is a Boolean rule for policies X and Y. This can include AND, OR and NOT operations.
https://medium.com/asecuritysite-when-bob-met-alice/telecoms-goes-post-quantum-with-attribute-based-...
Regards
Caute_Cautim
