Identity-Based Encryption Protocols Using Bilinear Pairing

Phase 1: Suppose a key extraction query is made on v = (v 1 , . . . , v j ) for j ≤ h. (Note that
j may be less than, equal to, or greater than u.)
If j ≤ u, then there must be a k ≤ j such that F k (v k ) ≢ 0 mod p, as otherwise v i ∈ Ii
∗
for each i ∈ {1, . . . , j} – which is not allowed by the rules of M 2 . In case j > u, it is
possible that F 1 (v 1 ) = · · · = F u (v u ) = 0. Then, since v u+1 ∈ Z ∗ p and F u+1 (x) = x, we have
F u+1 (v u+1 ) ≢ 0 mod p.
Thus, in all cases, there is a k such that F k (v k ) ≢ 0 mod p. We choose k to be the first
such value in the range {1, . . . , j} and so for i < k, we have F i (v i ) ≡ 0 mod p. We next show
that it is possible to construct a valid private key for v from what is known to the adversary.
Recall that Y i = α i P and hence Y i1 +i 2
= α i 1
Y i2 . Choose a random r in Z p and define
( j∑
) ( j∑
)
A 1 = βY 1 − 1 J i (v i )Y k + r (F i (v i )Y h−i+1 + J i (v i )P ) ;
F k (v k )
i=1
i=1
A 2 = − 1 ∑
F i (v i )Y h+k−i+1 ;
F k (v k )
A 3 =
i=j+1
i∈{1,...,j}\{k}
h∑
(
r(b i,0 P + a i,0 Y h−i+1 ) − 1
)
F k (v k ) (b i,0Y k + a i,0 Y h+k−i+1 ) .
It is possible to compute A 1 , A 2 and A 3 from what is known to the simulator. First note
that F k (v k ) ≢ 0 mod p and hence 1/F k (v k ) is well defined. The values F i (v i ), J i (v i ) and
P, Y 1 , . . . , Y h are known to the simulator. Hence, A 1 and A 3 can be computed directly.
In A 2 , the values Y h+2 , . . . , Y h+k are involved. However, the corresponding coefficients are
F k−1 (v k−1 ), . . . , F 1 (v 1 ). By definition, k is the first integer in the set {1, . . . , j} such that
F k (v k ) ≢ 0 mod p. Hence, F k−1 (v k−1 ) ≡ · · · ≡ F 1 (v 1 ) ≡ 0 mod p and consequently, the
values Y h+2 , . . . , Y h+k are not required by the simulator in computing A 2 .
The first component d 0 of the private key d v for v is obtained as d 0 = A 1 + A 2 + A 3 . The
following computation shows that this is proper.
d 0 = A 1 + A 2 + A 3
where
Now
A =
= ±Y h+1 + A 1 + A 2 + A 3
= Y h+1 + βY 1 − α k F k(v k )
= αP 2 +
)
(r − αk
A
F k (v k )
j∑
(J i (v i )P + F i (v i )Y h−i+1 ) +
i=1
J i (v i )P + F i (v i )Y h−i+1 =
∑n i
l=1
F k (v k ) Y h−k+1 + (A 1 − βY 1 ) + A 2 + A 3
h∑
i=j+1
(b i,0 P + a i,0 Y h−i+1 ) .
∑n i
b i,l viP l + a i,l viY l h−i+1 + b i,0 P + a i,0 Y h−i+1
l=1
98