I'm very interested in attribute-based encryption (ABE). I see various working examples online, and I want to know, has it been verified as production-ready? What does it mean to have a security audit, and how do I know if ABE is safe for use with real customer data?

The use case I have in mind is for powering role-based access control (RBAC) within a general-purpose framework for building apps. Example: David has built a cool diagramming and visualization app using a framework which implements RBAC using ABE, and he's deployed it to the cloud. Now Bob has used David's app to make a cool diagram, and he wants to give Alice read and write access to this document. He also wants to share it with Chelsea, but he wants her to have read-only access.

  • 4
    What do you define as "verified as production-ready"? Verified by whom, and for what context? For your personal website? For a 3-man company? For a hospital? Without knowing anything about your scope or your requirements, this is impossible to answer. – MechMK1 Feb 21 at 11:33
  • Fair enough. I've updated the question with requirements. – rm.rf.etc Feb 21 at 18:09
  • Why do you need ABE to implement RBAC? RBAC is simple enough to implement on its own - I don't understand what ABE adds to the standard methods – Conor Mancone Feb 21 at 19:34
  • The advantage is that the client app can dictate the policy without special logic built into the server-side application. – rm.rf.etc Feb 21 at 22:09
  • Aside from the above point, there's also a strong argument that an ABE-based approach would be inherently better than infrastructure-based approaches. medium.com/asecuritysite-when-bob-met-alice/… – rm.rf.etc Feb 21 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.