Identity-Based Encryption Protocols Using Bilinear Pairing

where ˜r = (r − αk
F k
). Also d 1 = − 1
F k
Y k +rP = − αk
F k
P +rP = ˜rP . For any j ∈ {1, . . . , m}\{k}
we have
˜rV j = (r − αk
F k
)(F j Y h−j+1 + J j P )
= r(F j Y h−j+1 + J j P ) − 1 F k
(F j Y h+k−j+1 + J j Y k ).
For j < k, F j = 0, so B can compute all these ˜rV j s from what it has. It forms
d 0 = d 0|k +
∑
j∈{1,...,m}\{k}
˜rV j = αP 2 + ˜r
m∑
V j .
To form a valid private key B also needs to compute ˜rP 3,j and ˜rQ j for m < j ≤ h. Now,
)
˜rP 3,j =
(r − αk
(c j P + v
F
jY ∗ h−j+1 )
k
j=1
= r(c j P + v ∗ jY h−j+1 ) − 1 F k
(
cj Y k + v ∗ jY h+k−j+1
)
;
For j ≤ u,
)
˜rQ j =
(r − αk
(β j P − Y h−j+1 ) = r(β j P − Y h−j+1 ) − 1 (β j Y k − Y h+k−j+1 )
F k F k
and for u < j ≤ h,
)
˜rQ j =
(r − αk
β j P = rβ j P − 1 β j Y k .
F k F k
All these values are computable from what is known to B. Hence, B forms the private key
as:
d v = (d 0 , d 1 , ˜rP 3,m+1 , . . . , ˜rP 3,h , ˜rQ m+1 , . . . , ˜rQ h )
and provides it to A.
Challenge: After completion of Phase 1, A outputs two messages M 0 , M 1 ∈ G 2 on which
it wishes to be challenged and v + = v1, ∗ . . . , vu ∗ where ′ u′ ≤ u ≤ h. B picks a random b ∈ {0, 1}
and provides A the challenge ciphertext
(
( u ′
) )
∑
CT = M b × T × e(Y 1 , βQ), Q, (c j + β j vj)
∗ × Q .
Suppose, Q = γP for some unknown γ ∈ Z p . Then
( u ′
)
(
∑
u ′
)
∑
c j + β j vj
∗ × Q = γ c j + β j vj
∗ P
j=1
j=1
114
j=1