Identity-Based Encryption Protocols Using Bilinear Pairing

decreases. However, the security of the HIBE degrades as l decreases. Hence, the decrease
in the size of the public parameters comes at an increase in the security degradation. This
trade-off can be converted into a trade-off between the memory required to store the public
parameters and the time required for the different operations. This space/time trade-off
has been studied in details in Chapter 5. A similar space/time trade-off also holds for the
present case.
8.3.1 Construction
Setup: Choose a random secret α ∈ Z p and set P 1 = αP . Randomly choose P 2 ; an h-
length vector −→ P 3 = (P 3,1 , . . . , P 3,h ); and h many l-length vectors −→ U 1 , . . . , −→ U h from G 1 , where
each −→ U j = (U j,1 , . . . , U j,l ). The public parameters consist of the elements
〈P, P 1 , P 2 , −→ P 3 , −→ U 1 , . . . , −→ U h 〉
while the master secret is αP 2 . Note that, for each level i of the HIBE we have l +1 elements
i.e., P 3,i and −→ U i .
Notation: Let v j be an n-bit string written as v j = (v j,1 , . . . , v j,l ), where each v j,i is an
(n/l)-bit string. Define
l∑
V j = P 3,j + v j,i U j,i .
The modularity introduced by this notation is useful in describing the protocol.
Key-Gen: Given an identity v = (v 1 , . . . , v k ) for k ≤ h, this algorithm generates the
private key d v of v as follows. Choose a random element r ∈ Z p and output
⎛ ⎛ ⎞
⎞
k∑
d v = ⎝xP 2 + r ⎝ V j
⎠ , rP, rP 3,k+1 , . . . , rP 3,h , r −→ U k+1 , . . . , r −→ U h
⎠
j=1
where r −→ U j = (rU j,1 , . . . , rU j,l ).
Note that, the private key for v can also be generated from the private key of (v 1 , . . . , v k−1 )
as is the general requirement for a HIBE scheme. Suppose the private key for (v 1 , . . . , v k−1 )
is (d ′ 0, d ′ 1, a ′ k , . . . , a′ h , −→ b ′ k , . . . , −→ b ′ h), where −→ b ′ i = 〈b ′ i,1, . . . , b ′ i,l 〉. Pick a random r′ ∈ Z p and then
d v = (d 0 , d 1 , a k+1 , . . . , a h , −→ b k+1 , . . . , −→ b h ), where
i=1
and for k + 1 ≤ j ≤ h.
d 0 = d ′ 0 + a ′ k + ∑ l
i=1 v k,ib ′ k,i + r′ ∑ k
j=1 V j;
d 1 = d ′ 1 + r ′ P ;
a j = a ′ j + r ′ P 3,j ;
−→
bj = −→ b ′ j + r ′ −→
Uj ,
101