Identity-Based Encryption Protocols Using Bilinear Pairing

Since b 0,1 , . . . , b 0,h , b 1 , . . . , b n are chosen randomly from Z p , the P 3,i s and the Q j s are random
elements of G 1 . The public parameters are given to the adversary. The master secret is aP 2 ,
which is not known to the simulator.
Now comes the most crucial part of the proof. For y ∈ Z p ,
V i (y) = P 3,i + yQ 1 + y 2 Q 2 + · · · + y n Q n
= a 0 P 2 + b 0,i P + y(a 1 P 2 + b 1 P ) + y 2 (a 2 P 2 + b 2 P ) + · · · + y n (a n P 2 + b n P )
= (a 0 + a 1 y + a 2 y 2 + · · · + a n y n )P 2 + (b 0,i + b 1 y + b 2 y 2 + · · · + b n y n )P
= F (y)P 2 + J i (y)P.
This decomposes V i (y) into two parts – one depends on P 2 and the other depends on P . The
part which depends on P 2 vanishes if and only if y is equal to some element of I ∗ . The ability
of the simulator to properly answer key extraction queries and generate a proper challenge
ciphertext depends crucially on this fact.
Phase 1: In this stage, the adversary can make queries to O k , all of which have to be
answered by the simulator. Suppose the adversary queries O k on an identity v = (v 1 , . . . , v j ),
with 1 ≤ j ≤ h. By the constraint of model M 1 all the v i ’s cannot be in I ∗ . Suppose ı is
such that v ı is not in I ∗ . Then F (v ı ) ≢ 0 mod p.
As in the protocol, define V i to be V i (v i ). Choose r 1 , . . ., r ı−1 , r ı, ′ r ı+1 , . . ., r j randomly
from Z p . Define W = ∑ j
i=1,i≠ı r iV i . The first component d 0 of the secret key for v =
(v 1 , . . . , v j ) is computed in the following manner.
d 0 = − J ı(v ı )
F (v ı ) P 1 + r ′ ı(F (v ı )P 2 + J ı (v ı )P ) + W.
The following computation shows that d 0 is properly formed.
d 0 = ±aP 2 − J ı(v ı )
F (v ı ) P 1 + r ı(F ′ (v ı )P 2 + J ı (v ı )P ) + W
(
= aP 2 + r ı ′ −
a )
(F (v ı )P 2 + J ı (v ı )P ) + W
F (v ı )
j∑
= aP 2 + r i V i
i=1
where r ı = r ′ ı − a/F (v ı ). Since r ′ ı is random, so is r ı . The quantities d 1 , . . . , d j are computed
in the following manner.
d i = r i P 1 ≤ i ≤ j, i ≠ ı;
= r ′ ıP − 1
F (v ı) P 1 = r ı P for i = ı.
This technique is based on the algebraic techniques introduced by Boneh and Boyen [17] as
discussed in Section 3.2.1. The generalization is in the definition of F () and J i ()s. Here we
take these to be polynomials, which allows us to tackle the case of adversary committing to
more than one identity.
88