Identity-Based Encryption Protocols Using Bilinear Pairing

Setup: Let P be a generator of G 1 . Choose a random secret x ∈ Z p and set P 1 = xP .
Randomly choose P 2 ; an l 1 × l 2 matrix R where
⎡
⎤
R 1,1 · · · R 1,l2
⎢
⎥
R = ⎣ . . . ⎦
R l1 ,1 · · · R l1 ,l 2
and l 2 many vectors −→ U 1 , . . . , −→ U l2 from G 1 , where each −→ U i = (U i,1 , . . . , U i,n ). The public
parameters are 〈P, P 1 , P 2 , R, −→ U 1 , . . . , −→ U l2 〉, while the master secret is xP 2 .
Key Generation: Given an identity v = (v 1 , . . . , v u ) for any u, this algorithm generates
the private key d v of v as follows.
Let u = k 1 l 2 + k 2 with k 2 ∈ {1, . . . , l 2 }. We represent v by a (possibly incomplete)
(k 1 + 1) × l 2 matrix I where the last row has k 2 elements. Choose (k 1 + 1) many random
elements r 1 , . . . , r k1 , r k2 ∈ Z p and output
(
(
∑k 1 h∑
) (
k2
)
∑
d ID = xP 2 + r i V i,j + R i,j + r k2 V k1 +1,j + R k1 +1,j , r 1 P, . . . , r k1 P, r k2 P,
i=1 j=1
j=1
)
−−−→ −→
r k2 R k1 +1,k 2 +1, . . . , r k2 R k1 +1,h, r k2 U k2 +1, . . . , r k2Ul2 where V i,j = ∑ n
−→
j=1 vj U i,j and r k2Ui denotes that each element of −→ U i is multiplied by the
scalar r k2 .
The private key of v can also be generated given the private key of v |u−1 = v 1 , . . . , v u−1
as required. There are two cases to be considered.
Case 1: Suppose u − 1 = k 1 l 2 + l 2 , then
(
(
k∑
1 +1 h∑
)
)
d v|u−1 = xP 2 + r i V i,j + R i,j , r 1 P, . . . , r k1 P, r k1 +1P
i=1 j=1
= (a 0 , a 1 , . . . , a k1 , a k1 +1) (say)
Choose a random r ∗ ∈ Z p and form d v as
d v = a 0 + r ∗ (V k1 +2,1 + R k1 +2,1), a 1 , . . . , a k1 +1, r ∗ P, r ∗ R k1 +2,2, . . . , r ∗ R k1 +2,h, r ∗ −→
U2 , . . . , r ∗ −→
Ul2
Case 2: Let, u − 1 = k 1 l 2 + k 2 ′ with k 2 ′ < l 2 then,
(
∑k 1 h∑
) ⎛
⎞
k
∑2
′
d v|u−1 = (xP 2 + r i V i,j + R i,j + r k ′ ⎝
2
V k1 ,j + P k1
⎠
+1,j , r 1 P, . . . , r k1 P, r k ′ 2
P,
i=1 j=1
j=1
r k ′ 2
R k1 +1,k 2 ′ +1 , . . . , r k ′ 2
R k1 +1,h, r k ′ −→
2
U k ′
2 +1, . . . , r k ′ −→
2
U l2
= (a 0 , a 1 , . . . , a k1 , a k1 +1, b k ′
2 +1, . . . , b l2 , −→ c k ′
2 +1, . . . , −→ c l2 ) (say)
121