Security Analysis of Attribute Revocation in Multi-Authority Data Access Control for Cloud Storage System

Yang et al. [1] have proposed a multi-authority CP-ABE based data access control for cloud storage (DAC-MACS), in which the authors claimed that the mechanism in dealing with attribute revocation could achieve both forward security and backward security. Unfortunately, our further analysis and investigation show that their work adopts a bidirectional re-encryption method in ciphertext updating, so a security vulnerability appears. Our proposed attack method demonstrates that a revoked user can still decrypt new ciphertexts that are claimed to require the new-version secret keys to decrypt.