Identity-Based Encryption Protocols Using Bilinear Pairing

Phase 2: A now issues additional queries just like Phase 1, with the (obvious) restriction
that it cannot place a decryption query for the decryption of C ∗ under v ∗ or any of its prefixes
nor a key-extraction query for the private key of v ∗ or any prefix of v ∗ . All other queries are
valid and A can issue these queries adaptively just like Phase 1. The challenger responds as
in Phase 1.
Guess: A outputs a guess γ ′ of γ.
The advantage of the adversary A in attacking the HIBE scheme H is defined as:
Adv H A = |Pr[(γ = γ ′ )] − 1/2| .
An h-HIBE scheme H is said to be (t, q ID , q C , ɛ)-secure against adaptive chosen ciphertext
attack ((t, q ID , q C , ɛ)-IND-ID-CCA secure) if for any t-time adversary A that makes at most
q ID private key queries and at most q C decryption queries, Adv H A ≤ ɛ. In short, we say H is
IND-ID-CCA secure or when the context is clear, simply CCA-secure.
2.5.2 Security Against Chosen Plaintext Attack
Security reduction of (H)IBE protocols available in the literature [49, 17, 19, 89] generally
concentrate on proving security in a weaker model. This is called security against chosen
plaintext attack. Boneh and Franklin [20] defines this notion as IND-ID-CPA security. The
corresponding game is similar to the game defined above, except that the adversary is not
allowed access to the decryption oracle O d . The adversary is allowed to place adaptive
private key extraction queries to the key-extraction oracle O k and everything else remains
the same. For the sake of completeness, we give a description of the IND-ID-CPA game for
an h-HIBE H below.
Setup The challenger takes input a security parameter 1 κ and runs the Setup algorithm of
the HIBE. It provides A with the system parameters PP while keeping the master key msk
to itself.
Phase 1: Adversary A makes a finite number of key-extraction query to O k . For a private
key query corresponding to an identity v, the key-extraction oracle generates the private key
d v of v and returns it to A. A is allowed to make these queries adaptively, i.e., any query
may depend on the previous queries as well as their answers.
Challenge: At this stage A fixes an identity, v ∗ and two equal length messages M 0 , M 1
under the (obvious) constraint that it has not asked for the private key of v ∗ or any of
its prefixes. The challenger chooses uniformly at random a bit γ ∈ {0, 1} and obtains a
ciphertext (C ∗ ) corresponding to M γ , i.e., C ∗ is the output of the Encryption algorithm on
input (M γ , v ∗ , PP). It returns C ∗ as the challenge ciphertext to A.
15