Identity-Based Encryption Protocols Using Bilinear Pairing

and outputs a random bit if there is no such j. Otherwise, it answers the query in a manner
similar to that in the proof of Theorem 8.2.1..
B chooses r randomly from Z p and computes
d 0|j = − J(v j)
F j (v j ) Y j + yY 1 + r(F j (v j )Y h−j+1 + J(v j )P );
d 1 =
−1
F j (v j ) Y j + rP.
It is standard to show that d 0|j = αP 2 +˜rV j and d 1 = ˜rP , where ˜r = r− αj
F j (I j
. As in the proof
)
of Theorem 8.2.1., it is possible to show that B can compute ˜rV i for any i ∈ {1, . . . , u} \ {j};
and ˜rP 3,k , ˜r −→ U k for u < k ≤ h. The simulator computes d 0 = d 0|j + ∑ i∈{1,...,u}\{j} ˜rV i. A is provided
the private key corresponding to v as d v =
(d 0 , d 1 , ˜rP 3,u+1 , . . . , ˜rP 3,h , ˜r −→ U u+1 , . . . , ˜r −→ )
U h .
Note that d v is a valid private key for v following the proper distribution. B will be able
to generate this d v as long as there is a j ∈ {1, . . . , u} such that F (v j , k j ) ≢ 0 for which it
suffices to have K(v j ) ≠ 0.
Challenge: A submits two messages M 0 , M 1 ∈ G 2 and an identity v ∗ = (v1, ∗ . . . , vh ∗ ′),
h ′ ≤ h on which it wants to be challenged. B aborts and outputs a random bit, if F j (vj) ∗ ≢ 0
for any j ∈ {1, . . . , h ′ }. Otherwise, B chooses a random bit γ ∈ {0, 1} and gives A the tuple
CT = (T × e(Y 1 , yQ) × M γ , Q, ∑ h ′
j=1 J(v∗ j)Q).
If 〈P, Q, Y 1 , . . . , Y h , T 〉 given to B is a valid h-wDBDHI ∗ tuple, i.e., T = e(P, Q) αh+1 then
CT is a valid encryption for M γ . Suppose Q = cP for some unknown c ∈ Z p . Then the first
component of CT can be seen to be e(P 1 , P 2 ) c . Further, using F j (vj) ∗ ≡ 0 mod p it can be
shown that J(vj)Q ∗ = cV j . The correctness of the third component of CT follows from this
fact. If T is a random element of G 2 , CT gives no information about B’s choice of γ.
Phase 2: Similar to Phase 1, with the restriction that A cannot ask for the private key of
ID ∗ or any of its ancestors.
Guess: A outputs a guess γ ′ of γ.
A lower bound λ on the probability of aborting up to this stage is the following.
λ =
1
2(4lq2 n/l ) h .
Waters [89] obtains a similar bound (for the case l = n) in the context of an IBE secure
in the full model under the DBDH assumption. In the same paper, Waters had suggested
a construction for HIBE where new public parameters are generated for each level of the
HIBE. Generating new public parameters for each level of the HIBE simplifies the probability
analysis for the lower bound on the probability of abort.
104