Abstract:Revocation encryption is a negative analogue of broadcast encryption. Unlike broadcast encryption, the input to the encryption algorithm is not a receiver set, but a set of revoked users. All users who are not in the revocation set within the system can decrypt the ciphertext successfully. Users in the revocation set learn nothing about the encrypted data, even in collusion. Compared to broadcast encryption, revocation encryption is more suitable for scenarios where most of the users in the system are the intended recipients and when revoking decryption rights for certain users is required. This study proposes a revocation encryption scheme based on the Chinese identity-based encryption standard SM9. The ciphertext size in the proposed scheme remains constant, and it is independent of the size of the revocation set. Based on a complex assumption in the generic group model, the scheme is proven secure against CPA under the random oracle model. Finally, the performance of the scheme is analyzed, and the results indicate that its computational costs and storage overheads are comparable to the existing revocation encryption schemes.