Identity-Based Encryption Protocols Using Bilinear Pairing

B declares the public parameters to be
(P, P 1 , P 2 , −→ P 3 , −→ Q 1 , . . . , −→ Q h ),
where −→ P 3 = (P 3,1 , . . . , P 3,h ) and −→ Q i = (Q i,1 , . . . , Q i,ni ). The corresponding master key
αP 2 = Y h+1 + βY 1 is unknown to B. The distribution of the public parameter is as expected
by A.
Phase 1: Suppose A asks for the private key corresponding to an identity v = (v 1 , . . . , v h ′)
for h ′ ≤ h. Note that for any i ≤ η ′ ,
∑n i
V i = P 3,i + v j i Q i,j
j=1
∑n i
= b i,0 P + a i,0 Y h−i+1 + v j i (b i,jP + a i,j Y h−i+1 )
j=1
= F i (v i )Y h−i+1 + J i (v i )P.
Hence, V i is computable from what is known to B.
Recall that A initially committed to sets of identities up to level u before the set-up
phase. If h ′ ≤ u, then there must be a k ≤ h ′ such that F k (v k ) ≠ 0, as otherwise v j ∈ Ij
∗ for
each j ∈ {1, . . . , h ′ } – which the adversary is not allowed by the rules of the Game. In case
h ′ > u, it is possible that F 1 (v 1 ) = · · · = F u (v u ) = 0. Then by construction F u+1 ≠ 0. So, in
either case there is a k such that F k (v k ) ≠ 0. Moreover, k is the first such index in the range
{1, . . . , h ′ }. B picks a random r ∈ Z p and assigns d 0|k = (−J k (v k )/F k (v k ))Y k + βY 1 + rV k and
d 1 = (−1/F k (v k ))Y k + rP. Now,
d 0|k = − J k(v k )
F k (v k ) Y k + βY 1 + α k Y h−k+1 − α k F k(v k )
F k (v k ) Y h−k+1 + rV k
= − J k(v k )
F k (v k ) αk P + αP 2 − α k F k(v k )
F k (v k ) Y h−k+1 + rV k
= αP 2 + ˜rV k
where ˜r = (r −
αk ). Also d F k (v k ) 1 = − 1 Y F k (v k ) k + rP = − αk
F k (v k
P + rP = ˜rP .
)
j ∈ {1, . . . , h ′ } \ {k} we have
For any
˜rV j = (r − αk
F k (v k ) )(F j(v j )Y h−j+1 + J j (v j )P )
= r(F j (v j )Y h−j+1 + J j (v j )P ) − 1
F k (v k ) (F j(v j )Y h+k−j+1 + J j (v j )Y k ).
Recall that, k is the smallest in the range {1, . . . , h ′ }, such that, F k (v k ) ≠ 0. Hence, for
j < k, F j (v j ) = 0 and ˜rV j = rJ j (v j )P − J j(v j )Y k
F k (v k ) . For j > k, Y h+k−j+1 varies between Y 1 to
118