Identity-Based Encryption Protocols Using Bilinear Pairing

generalisation and move on to address the issue of concrete security in the context of this
IBE protocol. To the best of our knowledge, this kind of concrete security analysis in the
IBE scenario was not much emphasised before.
Our next contribution is an extension of this IBE to HIBE. By reusing the public parameters,
we are able to significantly reduce the size of the public parameter. The security
reduction for the HIBE is not tight and suffers from a degradation along the line of the
earlier works in the full model (with or without random oracle). We propose another HIBE
secure in the full model in Chapter 8. This is a variant of constant size ciphertext HIBE
originally proposed by Boneh, Boyen and Goh modified along the line of our generalisation
of Waters suggestion in Chapter 5. In Table 10.1 we make a comparative study of these two
HIBEs with earlier suggestions in the same security model. For all these HIBEs the security
degradation is exponential in the number of levels. Consequently, construction of a HIBE in
the full model where the security degradation is sub-exponential in the number of levels is
an outstanding research problem in this area.
A weaker security model, called the selective-ID model has been suggested in the literature
where it is possible to avoid the security degradation. BB-HIBE and BBG-HIBE are the
only HIBE protocols proposed in this model. We augment this selective-ID security model
by allowing some flexibility to the adversary in choosing the target identity and call this
augmented version selective + -ID model. We show that BB-HIBE can be easily proved to be
secure in s + ID model and modify the original security reduction of BBG-HIBE to achieve
security in this model. The modified reduction of the BBG-HIBE introduces a multiplicative
security degradation. Next, we make some augmentation in the BBG-HIBE to achieve
security in s + ID model without any degradation. This new constant size ciphertext HIBE
secure in the s + ID model is called G 1 . In Table 10.2 we make a comparison of G 1 , BBG-HIBE
and BB-HIBE.
Though the selective-ID model for (H)IBE avoids security degradation, it is too restrictive
on the adversary. This motivated us to propose a generalisation of this model where the
adversary commits to sets of identities. In Chapter 7 we define two models M 1 and M 2
based on the adversarial behavior. Two HIBE protocols H 1 and H 2 secure respectively in
M 1 and M 2 are also suggested. These protocols can be seen as augmentation of the BB-
HIBE. We further propose a constant size ciphertext HIBE called ccHIBE by adapting the
BBG-HIBE in M 2 . Another constant size ciphertext HIBE G 2 secure in the augmented (in
the sense of s + ID model) M 2 is also suggested. A comparative study of these HIBEs is
given in Table 10.3
To conclude, the HIBE protocols proposed in the dissertation broaden the choice of
a designer of identity-based encryption protocols. Several different options of secure and
efficient HIBE protocols are now available to choose from. HIBE as a cryptographic primitive
has several interesting applications. Exploring these applications further based on the HIBEs
proposed here would be an interesting future work.
126