Identity-Based Encryption Protocols Using Bilinear Pairing

Y h . So B can compute all these ˜rV j s from the information it has. It forms
d 0 = d 0|k +
∑
j∈{1,...,h ′ }\{k}
∑h ′
˜rV j = αP 2 + ˜r V j .
To form a valid private key, B also needs to compute ˜rP 3,i and ˜r −→ Q i for h ′ < i ≤ h. Now,
)
˜rP 3,i =
(r − αk
(b i,0 P + a i,0 Y h−i+1 )
F k (v k )
= r(b i,0 P + a i,0 Y h−i+1 ) − 1
F k (v k ) (b i,0Y k + a j,0 Y h+k−i+1 ) ;
)
˜rQ i,j =
(r − αk
(b i,j P + a i,j Y h−i+1 )
F k (v k )
= r(b i,j P + a i,j Y h−i+1 ) − 1
F k (v k ) (b i,jY k + a i,j Y h+k−i+1 ) .
All these values are computable from what is known to B. Hence, B forms the private key
as:
d v =
(d 0 , d 1 , ˜rP 3,τ+1 , . . . , ˜rP 3,h , ˜r −→ Q τ+1 , . . . , ˜r −→ )
Q h
and provides it to A.
Challenge: After completion of Phase 1, A outputs two messages M 0 , M 1 ∈ G 2 together
with a target identity v ∗ = (v1, ∗ . . . , vu ∗ ′), u′ ≤ u, on which it wishes to be challenged. The
constraint is each vj ∗ ∈ Ij ∗ and hence F j (vj) ∗ = 0 for 1 ≤ j ≤ u ′ ≤ u. B picks a random
b ∈ {0, 1} and provides A the challenge ciphertext
CT =
(
M b × T × e(Y 1 , βQ), Q,
Suppose, Q = γP for some unknown γ ∈ Z p . Then
∑u ′
j=1
( u ′
j=1
) )
∑
J i (vi ∗ ) × Q .
i=1
∑u ′
( )
J j (vj)Q ∗ = γ Jj (vj)P ∗ + F j (vj)Y ∗ h−j+1
= γ
j=1
( u ′
)
∑
V j .
j=1
If the input provided to B is a true h-wDBDHI ∗ tuple, i.e., T = e(P, Q) (αh+1) , then
T × e(Y 1 , βQ) = e(P, Q) (αh+1) × e(Y 1 , βQ) = e(Y h + βP, Q) α = e(P 1 , P 2 ) γ .
119