Imagine you're building a combination lock where each tumbler is independently keyed, and you assume that knowing one tumbler tells you nothing about the others. Now imagine an attacker who can physically remove one tumbler — and discovers that the remaining tumblers weren't actually independent at all, because they shared internal wiring you thought was isolated. That's the structural flaw here: a cryptographic construction assumed coordinate-wise independence that didn't hold when an insider could peel back one layer. The paper by Xingwang Wang identifies a plaintext-recovery attack on the decentralized multi-authority attribute-based encryption (MA-ABE) scheme of Datta, Komargodski, and Waters, published in the Journal of Cryptology in 2023. The attack is devastating in its simplicity: a single corrupt authority, combined with two users whose attribute sets are individually unauthorized (even when pooled with the corrupt authority's attribute), can recover the plaintext. The root cause is a subtle but consequential error — the authors of the original scheme extended an LSSS (linear secret sharing scheme) matrix-normalization invariance property from complete secret shares to coordinate-wise ciphertext masks, where it doesn't hold. What goes wrong mechanically is this: a corrupt authority can expose the coordinate-wise masks and strip away the identity binding that should tie each user's decryption share to that user alone. Once identity binding is removed, decryption shares from different users become combinable in ways the security model was supposed to prevent. This is not a theoretical corner case — it works in the scheme's own claimed static security model. The repair is clean. Wang replaces the coordinate-wise masks with independent full linear sharings of zero. This restores the missing independence property without changing authority keys, user keys, decryption algorithms, or ciphertext size. The cost is modest: more encryption randomness and additional field arithmetic. Static security is proved under decisional bilinear Diffie-Hellman (DBDH) in the random oracle model, which is the same assumption family the original scheme targeted. The paper doesn't stop at one scheme. Wang extends the attack to both multi-authority attribute-based inner-product functional encryption (MA-AB-IPFE) constructions by Datta and Pal from PKC 2023. The same structural fix — independent sharings of zero — restores correctness and matrix-substitution invariance for both variants. For the small-universe variant, static security is proved under asymmetric DBDH. The large-universe variant has a separate problem: a missing source-group encoding in the original reduction. Wang formulates an augmented L-DBDH assumption, proves its hardness in the asymmetric generic bilinear group model, and provides a static security reduction. The broader lesson is a recurring one in pairing-based cryptography: LSSS-based constructions are seductive because the linear algebra is clean, but invariance properties that hold for complete shares do not automatically transfer to sub-components of ciphertext. This is the kind of error that passes peer review at top venues because the proof structure looks correct at the macro level — the flaw lives in one specific step where a property is assumed to carry over from one algebraic context to another. For practitioners, the message is concrete: if you implemented the DKW'23 MA-ABE scheme or the DP'23 MA-AB-IPFE schemes, you have a real vulnerability that is exploitable under the schemes' own threat model. The fix is available, preserves the API surface, and doesn't require re-keying beyond the encryption side. The cost is manageable. The urgency depends on whether corrupt-authority scenarios are realistic in your deployment — in decentralized multi-authority settings, they almost certainly are.
