Identity-Based Encryption Protocols Using Bilinear Pairing

Let a private key for (v 1 , . . . , v u−1 ) be (A ′ 0, A ′ 1, −→ B ′ u, . . . , −→ B ′ h), where
( u−1
)
∑
A ′ 0 = αP 2 + r ′ V j + P 3 ,
j=1
A ′ 1 = r ′ P , and for u ≤ j ≤ h, −→ B ′ j = (r ′ Q j,1 , . . . , r ′ Q j,nj ). Let B j,k ′ = r′ Q j,k . Pick a random
r ∗ ∈ Z p and compute d v = (A 0 , A 1 , −→ B u+1 , . . . , −→ B h ) where
A 0 = A ′ 0 + ∑ (
n ∑u
)
u
i=1 vi uB u,i ′ + r ∗ j=1 V j + P 3 ,
A 1 = A ′ 1 + r ∗ P,
B u+1 = −→ B ′ u+1 + r ∗ −→ Q u+1 ,
. . . ,
B h = −→ B ′ h + r ∗ −→ Q h .
If we put r = r ′ + r ∗ , then d v is a proper private key for v = (v 1 , . . . , v k ).
Encrypt: To encrypt M ∈ G 2 under the identity (v 1 , . . . , v u ) ∈ (Z ∗ p) k , pick a random
s ∈ Z p and output
(
( ))
u∑
e(P 1 , P 2 ) s × M, sP, s P 3 + V j .
Decrypt:
To decrypt (A, B, C) using the private key d v = (d 0 , d 1 , . . .), compute
( (
A × e(d 1, C)
e rP, s P 3 + ∑ ))
u
e(B, d 0 ) = e(P 1, P 2 ) s j=1 V j
× M ×
)) = M.
j=1
(
e sP, αP 2 + r
(
P 3 + ∑ k
j=1 V j
Note: ccHIBE is parametrized by (n 1 , . . . , n h ) and we will write (h, n 1 , . . . , n h )-ccHIBE to
explicitly denote this parametrization.
8.2.2 Security Reduction
We wish to show that ccHIBE is secure in model M 2 . Recall that Adv is used to denote
the advantage of an adversary in attacking a HIBE. By the notation Adv (h,n 1,...,n h )-ccHIBE
(h,n ′ 1 ,...,n′ )-M (t, q)
h 2
we will denote the maximum advantage of an adversary which runs in time t and makes q
key-extraction queries in attacking (h, n 1 , . . . , n h )-ccHIBE in the model (h, n ′ 1, . . . , n ′ h )-M 2.
Theorem 8.2.1. Let h, n 1 , . . . , n h , q be positive integers and n ′ 1, . . . , n ′ h
positive integers with n ′ i ≤ n i for 1 ≤ i ≤ h. Then
be another set of
Adv (h,n 1,...,n h )-ccHIBE
(h,n ′ 1 ,...,n′ )-M (t, q) ≤ Adv h-wDBDHI∗ (t + O(τnq))
h 2
96