Identity-Based Encryption Protocols Using Bilinear Pairing

More documents

Recommendations

Info

4.2.1 The Tate Pairing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 4.2.2 Miller’s Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 4.2.3 Choice of Curves . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 4.2.4 Non-Adjacent Form Representation . . . . . . . . . . . . . . . . . . . 39 4.3 Encapsulated Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 4.3.1 Encapsulated Point Doubling and Line Computation . . . . . . . . . 40 4.3.2 Encapsulated (Mixed) Point Addition and Line Computation . . . . . 41 4.4 Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 4.4.1 Double-and-Add . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 4.4.2 Iterated Doubling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 4.4.3 Memory Requirement . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 4.4.4 Parallelism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 4.5 Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 4.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 5 Identity-Based Encryption in Full Model 49 5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5.2 Generalisation of Waters’ IBE . . . . . . . . . . . . . . . . . . . . . . . . . . 50 5.2.1 Security Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 5.3 Concrete Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 5.3.1 Space/time trade-off . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 5.4 CCA Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 5.5 Signature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 5.5.1 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 5.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 6 Extending IBE to HIBE with Short Public Parameters 63 6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 6.2 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 6.3 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 6.3.1 Security Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 6.3.2 Lower Bound on Not Abort . . . . . . . . . . . . . . . . . . . . . . . 71 6.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 7 Generalization of the Selective-ID Security Model 76 7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 7.2 Another Look at Security Model . . . . . . . . . . . . . . . . . . . . . . . . . 77 7.2.1 Full Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 7.2.2 Selective-ID Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 7.2.3 New Security Models . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 7.3 Interpreting Security Models . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 7.4 Constructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 vi
7.4.1 HIBE H 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 7.4.2 HIBE H 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 7.5 Security Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 7.5.1 Security Reduction for H 1 . . . . . . . . . . . . . . . . . . . . . . . . 85 7.5.2 Security Reduction for H 2 . . . . . . . . . . . . . . . . . . . . . . . . 89 7.6 Multi-Receiver IBE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 7.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91 8 Constant Size Ciphertext HIBE 93 8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 8.2 ccHIBE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 8.2.1 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 8.2.2 Security Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 8.3 FullccHIBE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 8.3.1 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 8.3.2 Security Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 8.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 9 Augmented Selective-ID Model: Case of Constant Size Ciphertext HIBE105 9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 9.2 From Selective-ID to Selective + -ID Model . . . . . . . . . . . . . . . . . . . 106 9.2.1 Case of Boneh-Boyen HIBE . . . . . . . . . . . . . . . . . . . . . . . 106 9.2.2 Case of Boneh-Boyen-Goh HIBE . . . . . . . . . . . . . . . . . . . . 107 9.3 Constant Size Ciphertext HIBE in Selective + -ID Model . . . . . . . . . . . . 109 9.3.1 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 9.3.2 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111 9.4 Augmenting to M + 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 9.4.1 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 9.4.2 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 9.5 Composite Scheme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 9.5.1 Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 9.5.2 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 9.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 9.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 10 Conclusion 124 vii
Page 1: Construction of (Hierarchical) Iden
Page 5: The scientist does not study nature
Page 9: Contents 1 Introduction 1 1.1 Plan
Page 14 and 15: the public key. In this setting, an
Page 16 and 17: adversary in distinguishing two mes
Page 18 and 19: previous chapter. The second varian
Page 20 and 21: as it is closer to the known exampl
Page 22 and 23: Let P i = a i P . An algorithm A ha
Page 24 and 25: Given the security parameter κ, th
Page 26 and 27: the Key-Gen algorithm and C is the
Page 28 and 29: Phase 2: A now issues additional qu
Page 30 and 31: Chapter 3 Previous Works in Identit
Page 32 and 33: Decrypt: Decrypt C = 〈U, V 〉 us
Page 34 and 35: Game 2 Suppose B is given a BDH pro
Page 36 and 37: Security of BasicHIBE against chose
Page 38 and 39: BB-HIBE Here individual components
Page 40 and 41: F i (v ∗ i ) = α i P , so C =
Page 42 and 43: Key-Gen: Let v = (v 1 , . . . , v n
Page 44 and 45: Composite HIBE Boneh, Boyen and Goh
Page 46 and 47: Security Given an identity tuple v
Page 48 and 49: Chapter 4 Tate Pairing in General C
Page 50 and 51: order on the elliptic curve E(IF p
Page 52 and 53: the best result. In [57] the author
Page 54 and 55: Hence, we require 3[S] + 8[M] for E
Page 56 and 57: Algorithm 2 (iterated doubling): In
Page 58 and 59: Level 1 : t 1 = Y 2 1 ; t 4 = Z 2 1
Page 60 and 61:
Table 4.1: Cost Comparison. Note 1[
Page 62 and 63:
problem. - Our construction resembl
Page 64 and 65:
is equal to c 2 |IF a | 3 . Thus, t
Page 66 and 67:
aborts if F (v ∗ ) ≠ 0 and outp
Page 68 and 69:
DBDH problem over (G 1 , G 2 , e) i
Page 70 and 71:
these are respectively 2.4 kb and 2
Page 72 and 73:
Signing: Let M = (m 1 , m 2 , . . .
Page 74 and 75:
model without random oracles. Addit
Page 76 and 77:
6.2 Construction HIBE-spp The ident
Page 78 and 79:
Table 6.1: Comparison of HIBE Proto
Page 80 and 81:
For 1 ≤ j ≤ h, we define severa
Page 82 and 83:
establish the claim. We provide the
Page 84 and 85:
The probability is over the indepen
Page 86 and 87:
= ≥ ( ( 1 − Pr 1 − [( q∨ i=
Page 88 and 89:
of public parameters is significant
Page 90 and 91:
to be I ∗ . It can then ask for t
Page 92 and 93:
Phase 2: The adversary issues addit
Page 94 and 95:
7.3 Interpreting Security Models Th
Page 96 and 97:
7.4 Constructions We present severa
Page 98 and 99:
7.4.2 HIBE H 2 The description of H
Page 100 and 101:
Since b 0,1 , . . . , b 0,h , b 1 ,
Page 102 and 103:
For 1 ≤ i ≤ h, we have V i (y)
Page 104 and 105:
1. The encryption is converted into
Page 106 and 107:
Chapter 8 Constant Size Ciphertext
Page 108 and 109:
Let a private key for (v 1 , . . .
Page 110 and 111:
Phase 1: Suppose a key extraction q
Page 112 and 113:
= γ ( P 3 + ) u∑ V i . i=1 If th
Page 114 and 115:
Encrypt: To encrypt a message M ∈
Page 116 and 117:
and outputs a random bit if there i
Page 118 and 119:
Chapter 9 Augmented Selective-ID Mo
Page 120 and 121:
Phase 1 and Phase 2: As discussed i
Page 122 and 123:
an adversary has to commit to an id
Page 124 and 125:
Table 9.1: Comparison of BBG-HIBE a
Page 126 and 127:
where ˜r = (r − αk F k ). Also
Page 128 and 129:
The maximum height of the HIBE be h
Page 130 and 131:
B declares the public parameters to
Page 132 and 133:
So, the challenge ciphertext is ( C
Page 134 and 135:
Choose a random r ∗ ∈ Z p and f
Page 136 and 137:
The size of the private key in the
Page 138 and 139:
generalisation and move on to addre
Page 140 and 141:
Table 10.3: Comparison of HIBE prot
Page 142 and 143:
[9] Paulo S. L. M. Barreto, Ben Lyn
Page 144 and 145:
[31] Sanjit Chatterjee and Palash S
Page 146 and 147:
[55] Florian Hess, Nigel P. Smart,
Page 148:
[81] Palash Sarkar. Head: Hybrid en
show all

Identity-Based Encryption Protocols Using Bilinear Pairing

Create successful ePaper yourself

Delete template?

Save as template?