Mathematical Integrity Audit: 'Policy-Hiding Bilateral Attribute-Based Access Control Scheme' (Guo et al., 2025)

Academic fraud report · Geng Detector

Summary

This report examines four flagged issues in the cryptographic paper 'Policy-Hiding Bilateral Attribute-Based Access Control Scheme' by Guo Lifeng, Sun Wenzhe, and Zhao Yu, published in the Journal of Shanxi University (Natural Science Edition), DOI: 10.13451/j.sxu.ns.2025008. The overall verdict is confirmed severe. The most critical finding concerns the partial decryption correctness proof (Section 4.1.1), where exponents b1^2 and b2^2 vanish from the derivation of D3 and D4 without algebraic justification—a fundamental breach of bilinear-map rules that invalidates the security argument. A second severe error shows systematic index confusion between sender attributes (att_{S,i}) and receiver attribute-set cardinality j, suggesting unchecked copy-paste from another scheme. A third issue notes typographic/symbolic manipulation in the EUF-CMA proof (Theorem 2, Section 4.2) where b^2 is re-rendered as b_2 to force an equality. A minor but telling error lists reference [13] with a duplicated author name (Riepel D appearing twice) versus the actual two-author ACM CCS 2022 paper. Confidence is high on the algebraic issues; the paper's claimed proofs are non-self-consistent on their face.

Verdict

🔴 Confirmed severe. The cryptographic correctness and security proofs contain fundamental algebraic inconsistencies and copy-paste artifacts that undermine the paper's claimed contributions.

Key findings

Fatal algebraic error in correctness proof (Section 4.1.1, p. 7): During the derivation of partial-decryption components D3 and D4, the exponent b_1^2 (and b_2^2 for D4) disappears without justification. By bilinearity, e(∏ tk_{3,i}^{η_j}, c_3) should carry exponent r·b_1^2·s_1, but the authors' expression drops the square term—a fabricated step to force the final equality.
Systematic sender/receiver index confusion (Section 3 encryption algorithm, p. 6, and Section 4.1.1, p. 7): The encryption loop uses i ∈ [j] (where j indexes receiver attributes) but the hash input is H(att_{S,i})—a sender attribute—indicating unchecked copy-paste from a different scheme.
Symbolic manipulation in EUF-CMA proof (Section 4.2, Theorem 2, p. 8): With B_1 = g_1^b and B_2 = g_2^b, the equality e(A_1, B_2) = e(g_1, g_2)^{b_2 · a/b} reinterprets b^2 as a subscripted variable b_2, conflicting with the independently chosen randomness b_1, b_2.
Reference [13] bibliographic error (p. 10): The author list is rendered as "RIEPEL D, WEE H, RIEPEL D, et al."; the actual ACM CCS 2022 'Fabeo' paper is by Riepel D and Wee H only—evidence of careless .bib reuse.

Evidence highlights

Quoted equation chain for D_3 shows the exponent transition r·b_1·s_1 → r·s_1 (loss of b_1), violating bilinearity.
Index mismatch: encryption iterates i ∈ [j] (receiver cardinality) while hashing sender attributes att_{S,i}.
Reference [13] duplicate author name confirmed against the public ACM CCS 2022 record.

Notes

DOI: 10.13451/j.sxu.ns.2025008
The report's mathematical claims are verifiable from the published PDF without external tools.
Findings describe surface-level proof inconsistencies; a full cryptographic review would require extending the analysis to the underlying security model and any companion code.
This translation is provided for academic-integrity discussion; final determination rests with the journal's editorial investigation.