Identity-Based Encryption Protocols Using Bilinear Pairing

the Key-Gen algorithm and C is the output of the Encrypt algorithm for a message M ∈ M
using v as a public key and PP; then the Decrypt algorithm must return M on input d v and
C.
2.5 Security Model of (H)IBE
As we have already noted, HIBE is a generalisation of IBE i.e., an IBE can be thought of as a
single level HIBE. So instead of describing the security models of IBE and HIBE separately,
we only describe the security model of HIBE.
2.5.1 Security Against Chosen Ciphertext Attack
In case of public key encryption, we have seen that security against adaptive chosen ciphertext
attack is the standard notion of security. Boneh and Franklin extended this notion of
security to the identity-based setting [20]. They termed this as IND-ID-CCA security.
Let H be an h-HIBE scheme as defined in the previous section. The IND-ID-CCA security
for H is defined [56, 49, 17] in terms of the following game between a challenger and an
adversary of the HIBE. The adversary is allowed to place two types of oracle queries –
decryption queries to a decryption oracle O d and key-extraction queries to a key-extraction
oracle O k .
Setup The challenger takes input a security parameter 1 κ and runs the Setup algorithm of
the HIBE. It provides A with the system parameters PP while keeping the master key msk
to itself.
Phase 1:
two types:
Adversary A makes a finite number of queries where each query is one of the
• key-extraction query 〈v〉: This query is placed to the key-extraction oracle O k . O k
generates a private key d v of v and returns it to A.
• decryption query 〈v, C〉: This query is placed to the decryption oracle O d . It returns
the resulting plaintext to A.
A is allowed to make these queries adaptively, i.e., any query may depend on the previous
queries as well as their answers.
Challenge: When A decides that Phase 1 is complete, it fixes an identity v ∗ and two equal
length messages M 0 , M 1 under the (obvious) constraint that it has not asked for the private
key of v ∗ or any prefix of v ∗ . The challenger chooses uniformly at random a bit γ ∈ {0, 1}
and obtains a ciphertext C ∗ corresponding to M γ , i.e., C ∗ is output of the Encrypt algorithm
on input (M γ , v ∗ , PP). It returns C ∗ as the challenge ciphertext to A.
14