Identity-Based Encryption Protocols Using Bilinear Pairing

Decrypt: Decrypt C = 〈U, V 〉 using the private key d v as V ⊕ H 2 (e(d v , U)) = M.
Suppose, for some identity v in BasicIdent, H 1 (v) is mapped to Q v of BasicPub. Then the
Key Generation, Encryption and Decryption algorithms of BasicPub essentially corresponds
to the respective algorithms of BasicIdent for the identity v.
Let A 1 be an IND-ID-CPA adversary against BasicIdent and A 2 is an IND-CPA adversary
against BasicPub, while B is an algorithm that solves the given BDH problem. The reduction
proceeds in two steps. In the first step which we denote as Game 1, A 1 is used to construct
A 2 . In the next step which we call Game 2, A 2 is used to construct B.
B plays the role of challenger in the IND-CPA game with A 2 . It runs the Key Generation
algorithm of BasicPub and gives pk = 〈P, P pub , Q v , H 2 〉 to A 2 . The secret key d v = sQ v is
not revealed. From pk, A 2 passes on P, P pub and H 2 to A 1 . A 2 keeps Q v to itself and uses
it to form H 1 . The crux of the proof in the first step is in the construction of H 1 ().
To pose as a proper challenger to A 1 , A 2 should be able to answer the key extraction
queries and also to generate a valid challenge. In simulating H 1 (), A 2 randomly partitions
the identity space I into two disjoint subsets I 1 and I 2 in such a way that it is able to form
a proper private key if and only if the queried identity is from I 1 . Similarly, it can form
a proper challenge ciphertext if and only if the challenge identity is from I 2 . It aborts the
game if the key extraction query is for an identity from I 2 or the challenge identity is from
I 1 . This in turn results in a degradation in the security reduction.
This is an intuitive explanation of the principal strategy in the security reduction of
Game 1. In fact, partitioning of the identity space into two disjoint subsets, such that the
private key queries can be answered for one subset, while a proper challenge can only be
generated for a member of the second – this is a hallmark of the security reduction (with or
without random oracle) of all the identity-based encryption schemes that we describe in this
chapter.
Given this intuitive understanding, we now proceed for a more formal description.
Game 1
H 1 -queries: A 1 can query the random oracle H 1 () at any time during the game. A 2
maintains a list called H1 list to answer such queries. The ith entry to the list is a 4-tuple,
〈v i , Q i , b i , c i 〉 ∈ {0, 1} ∗ × G ∗ 1 × Z ∗ p × {0, 1}. Suppose A 1 places a query to H 1 () for the identity
v j . A 2 responds to this query in the following way.
• If v j already exists in H list
1 as 〈v j , Q j , b j , c j 〉 then A 2 returns H 1 (v j ) = Q j .
• Otherwise A 2 takes the following steps.
– Generate a random c ∈ {0, 1} where Pr[c = 0] = δ for some δ which is fixed
a-priori for all queries.
– Pick a random b ∈ Z ∗ p and set Q j = bP if c = 0; otherwise set Q j = bQ v .
– Add 〈v j , Q j , b, c〉 to H list
1 and return H 1 (v j ) = Q j to A 1 .
20