Identity-Based Encryption Protocols Using Bilinear Pairing

Y i = α i P for some random α ∈ Z ∗ p and T is either equal to e(P, Q) αh+1 or a random element
of G 2 . We define the s + ID game between B and A as follows.
Initialization: A outputs an identity tuple v ∗ = (v1, ∗ . . . , vu) ∗ ∈ (Z p ) u for any u ≤ h. The
restriction on A is that it cannot ask for the private key of v ∗ or any of its prefixes and in
challenge stage it asks for an encryption under v ∗ or any of its prefixes. In case u < h, B
chooses random vu+1, ∗ . . . , vh ∗ from Z p and keeps these extra elements to itself. (Note that B
is not augmenting the target identity to create a new target identity.)
Setup:
B picks random β, β 1 , . . . , β h and c 1 , . . . , c h in Z p . It then sets
P 1 = Y 1 = αP ; P 2 = Y h + βP = (α h + β)P ; and for 1 ≤ j ≤ u,
Q j = β j P − Y h−j+1 ; P 3,j = c j P + v ∗ jY h−j+1 ; and for u < j ≤ h,
Q j = β j P ; P 3,j = c j P + v ∗ jY h−j+1 .
B declares the public parameter as (P, P 1 , P 2 , −→ P 3 , −→ Q), where −→ Q = (Q 1 , . . . , Q h ), −→ P 3 =
(P 3,1 , . . . , P 3,h ). The corresponding master key αP 2 = Y h+1 +βY 1 is unknown to B. B defines
the functions F j = v ∗ j − v j for 1 ≤ j ≤ u and F j = v ∗ j for u < j ≤ h and J j = c j + β j v j for
1 ≤ j ≤ h.
Phase 1: Suppose A asks for the private key corresponding to an identity v = (v 1 , . . . , v m )
for m ≤ h. Note that for any j ≤ u,
Similarly, for u < j ≤ h
V j = P 3,j + v j Q j
= c j P + vjY ∗ h−j+1 + v j (β j P − Y h−j+1 )
= (v ∗ j − v j )Y h−j+1 + (c j + β j v j )P
= F j Y h−j+1 + J j P.
V j = P 3,j + v j Q j = c j P + v ∗ jY h−j+1 + v j β j P = F j Y h−j+1 + J j P.
Hence, V j for 1 ≤ j ≤ h is computable from what is known to B.
Recall that u is the length of v ∗ that the adversary committed to before the set-up phase.
If m ≤ u, then there must be a k ≤ τ such that F k ≠ 0, as otherwise the queried identity is
a prefix of the target identity. In case m > u, it is possible that F 1 = · · · = F u = 0. Then
by construction, F u+1 ≠ 0. Let k be the smallest in {1, . . . , m} such that F k ≠ 0. B picks a
random r ∈ Z p and assigns d 0|k = (−J k /F k )Y k + βY 1 + rV k and d 1 = (−1/F k )Y k + rP. Now,
d 0|k = − J k
F k
Y k + βY 1 + α k Y h−k+1 − α k F k
F k
Y h−k+1 + rV k = αP 2 + ˜rV k
113