Identity-Based Encryption Protocols Using Bilinear Pairing

∑u ′
(
= γ cj P + vjY ∗ h−j+1 + vj(β ∗ j P − Y h−j+1 ) )
j=1
∑u ′
( )
= γ P3,j + vjQ ∗ j
= γ
j=1
( u ′
)
∑
V j .
j=1
If the input provided to B is a true h-wDBDHI ∗ tuple, i.e., T = e(P, Q) (αh+1) , then
T × e(Y 1 , βQ) = e(P, Q) (αh+1) × e(Y 1 , βQ) = e(Y h + βP, Q) α = e(P 1 , P 2 ) γ .
So, the challenge ciphertext is
(
CT =
M b × e(P 1 , P 2 ) γ , γP, γ
( u ′
))
∑
V j .
CT is a valid encryption of M b under v + = (v1, ∗ . . . , vu ∗ ′). On the other hand, when T is
random, CT is random from the view point of A.
j=1
Phase 2:
2 together.
This is similar to Phase 1. Note that A places at most q queries in Phase 1 and
Guess: Finally, A outputs its guess b ′ ∈ {0, 1}. B outputs 1 ⊕ b ⊕ b ′ .
A’s view in the above simulation is identical to that in a real attack. This gives us the
required bound on the advantage of the adversary in breaking the HIBE protocol.
9.4 Augmenting to M + 2
Like the augmentation of the selective-ID model to selective + -ID model, we can augment
M 2 proposed in Chapter 7 in an obvious way to M + 2 . Suppose the adversary of an h-HIBE
has committed to a set of target identities, I ∗ 1, . . . , I ∗ u where u ≤ h. Then in the challenge
phase it outputs a target identity v ∗ 1, . . . , v ∗ u ′ where 1 ≤ u′ ≤ u and each v ∗ j ∈ I ∗ j .
The HIBE H 2 proposed in Chapter 7 is also secure in M + 2 . ccHIBE of Chapter 8 secure
in M 2 can be proved to be secure in M + 2 with a multiplicative security degradation of h.
Here, we show how G 1 can be augmented to M + 2 .
9.4.1 Construction
We augment G 1 to obtain security in model M + 2 and call this new protocol (h, n 1 , . . . , n h )-G 2
or simply G 2 .
115