Identity-Based Encryption Protocols Using Bilinear Pairing

as it is closer to the known examples of bilinear maps and also because our work includes
(Chapter 4) an algorithm to compute the modified Tate pairing. To maintain the consistency
of notation through out the work, we rewrite some of the protocols reviewed in Chapter 3
in the additive-multiplicative notation.
Note that, the bilinear pairing can be more generally defined in the asymmetric setting
[22, 24]. Let ê : G 1 × Ĝ1 → G 2 be one such bilinear map, where G 1 and Ĝ1 are two
(possibly) distinct groups. The properties of bilinearity, non-degeneracy and computability
hold for ê(), but not the symmetry property. In this work we use symmetric bilinear map.
Hence, asymmetric bilinear map is not discussed any further.
2.2 Hardness Assumption
Security of identity-based encryption protocols described in this dissertation rely on the
hardness of the bilinear Diffie-Hellman (BDH) problem formally introduced by Boneh and
Franklin in [20] or one of its variants. In this section we define the problems and the
corresponding security assumptions relevant to our work.
2.2.1 Bilinear Diffie-Hellman Assumption
Let G be a randomized algorithm which takes input a security parameter κ ∈ Z + , runs in
time polynomial in κ and outputs a prime number p, descriptions of two groups G 1 , G 2 of
order p and an admissible bilinear map e : G 1 × G 1 → G 2 as defined in Section 2.1. Here
log 2 (p) = Θ(κ), so κ is used to determine the cardinality of the groups G 1 , G 2 (i.e., p). Let
G(1 κ ) = 〈p, G 1 , G 2 , e〉 denote the output of G on input κ. We assume that the descriptions
include polynomial time (in κ) algorithms to compute the group operations in G 1 , G 2 as well
as a polynomial time algorithm for evaluating e(). Let Z p = Z/pZ and Z ∗ p = Z p \ {0}.
Bilinear Diffie-Hellman Problem: Let G 1 , G 2 , e() be as defined in Section 2.1.The bilinear
Diffie-Hellman problem (BDH) in 〈G 1 , G 2 , e()〉 is the following.
Given P, aP, bP, cP ∈ G 1 where P is a generator of G 1 and a, b, c are random elements
of Z ∗ p; compute e(P, P ) abc .
BDH Assumption: An algorithm A is said to have an advantage ɛ(κ) in solving the BDH
problem in 〈G 1 , G 2 , e()〉, generated by G(1 κ ) if
Adv G,A (κ) = Pr
[
A(p, G 1 , G 2 , e, P, aP, bP, cP ) = e(P, P ) abc ∣ ∣∣∣∣ 〈p, G 1 , G 2 , e()〉 ← G(1 κ ),
P $ ← G 1 , a, b, c $ ← Z ∗ p
]
≥ ɛ(κ)
The (t(κ), ɛ(κ))-bilinear Diffie-Hellman assumption holds in 〈G 1 , G 2 , e()〉 generated by G
if no t(κ)-time algorithm A, where t(κ) is a polynomial in κ, has at least a non-negligible
8