Identity-Based Encryption Protocols Using Bilinear Pairing

Encrypt: To encrypt a message M ∈ G 2 under the public key v = (v 1 , . . . , v k ) choose a
random s ∈ Z p and then the cipher text is
C =
(
e(P 1 , P 2 ) s × M, sP, s
where V j is as defined in Key Generation part.
)
k∑
V j
Decrypt: Let (A, B, C) be a ciphertext and v = (v 1 , . . . , v k ) be the corresponding identity.
Then we decrypt using d v = (d 0 , d 1 , . . .) as
A × e(d 1, C)
e(B, d 0 ) = M.
Note that, only the first two components of the private key are required for the decryption.
j=1
8.3.2 Security Reduction
Security of the FullccHIBE scheme described above can be reduced from the hardness of the
h-wDBDHI ∗ problem. The reduction combines ideas from the proof in Section 8.2.2 with
ideas from the proofs in Chapter 5. In particular, the general idea of tackling adaptive
adversaries including an “artificial abort” stage is from Waters [89], the modification for the
case of 1 < l ≤ n is from Chapter 5 whereas the idea of the simulation of the key-extraction
queries is from the proof in Section 8.2.2 and is based on algebraic techniques originally used
by Boneh and Boyen [17]. To explain this idea further, the simulator in the proof will abort
on certain queries made by the adversary and also on certain challenge identities. The idea
of controlling this abort strategy is based on the technique from [89]. On the other hand, if
on a certain query, the simulator does not abort, then the technique for the actual simulation
of the key-extraction oracle is very similar to the technique in Section 8.2.2.
The challenge generation is a bit different due to the fact that in FullccHIBE level j of
the HIBE has a parameter P 3,j , whereas in ccHIBE, there is one parameter P 3 for all levels of
the HIBE. In case of BBG-HIBE or its augmented version ccHIBE, the height of the target
identity is fixed in the commitment stage itself. Based on this information the simulator sets
up the HIBE and the effect of the committed identity tuple for BBG-HIBE or the sets of
committed identities in ccHIBE is assimilated in P 3 . In case of FullccHIBE there is no prior
commitment stage in the reduction and the number of levels in the target identity may vary
between 1 and h. This is the intuitive reason of why we need different P 3,i for each level of
the HIBE.
Theorem 8.3.1. The FullccHIBE protocol is (ɛ, t, q)-IND-ID-CPA secure assuming that the
(t ′ , ɛ ′ , h)-wDBDHI ∗ assumption holds, where
102