Identity-Based Encryption Protocols Using Bilinear Pairing

Hence,
This shows
A =
=
∑n i
l=1
v l iQ i,l + b i,0 P + a i,0 Y h−i+1
= V i + b i,0 P + a i,0 Y h−i+1 .
j∑
V i +
i=1
= P 3 +
h∑
(b i,0 P + a i,0 Y h−i+1 )
i=1
j∑
V i .
i=1
d 0 = αP 2 + r ′ (P 3 +
)
j∑
V i
where ˜r = r − (α k /F k (v k )). Since r is random, so is ˜r and hence d 0 is properly formed. Also,
i=1
d 1 = − 1
F k (v k ) Y k + rP = −
αk
P + rP = ˜rP
F k (v k )
which is as required. To form a valid private key ˜r −→ Q i has to be computed for j < i ≤ h.
This is done as follows.
)
˜rQ i,l =
(r − αk
(b i,l P + a i,l Y h−i+1 )
F k (v k )
= r(b i,l P + a i,l Y h−i+1 ) − 1
F k (v k ) (b i,lY k + a i,l Y h+k−i+1 ) .
Thus, we get
d v =
(d 0 , d 1 , ˜r −→ Q j+1 , . . . , ˜r −→ Q h
)
.
Challenge: After completion of Phase 1, the adversary outputs two messages M 0 , M 1 ∈ G 2
together with a target identity v ∗ = (v1, ∗ . . . , vu) ∗ on which it wishes to be challenged. The
constraint is each vi ∗ ∈ Ii ∗ and hence F i (vi ∗ ) ≡ 0 mod p for 1 ≤ i ≤ u. If u ≤ h, then
a j,0 = 0 for u ≤ j ≤ h. The simulator picks a random b ∈ {0, 1} and constructs the challenge
ciphertext (
( u∑
) )
h∑
M b × T × e(Y 1 , βQ), Q, J i (vi ∗ ) + b i,0 Q .
i=1
i=u+1
Suppose, Q = γP for some unknown γ ∈ Z p . Using the fact F i (vi ∗ ) ≡ 0 mod p for 1 ≤ i ≤ u
and a i,0 = 0 for u + 1 ≤ i ≤ h, we have
( u∑
) (
h∑
u∑
)
h∑
J i (vi ∗ ) + b i,0 Q = γ (J i (vi ∗ )P + F i (vi ∗ )Y h−i+1 ) + (a i,0 Y h−i+1 + b i,0 P )
i=1
i=u+1
i=1
i=u+1
99