Identity-Based Encryption Protocols Using Bilinear Pairing

Security of BasicHIBE against chosen plaintext attack (i.e., IND-ID-CPA security) can
be proved in the same manner as that of the BasicIdent of previous section. In the first
stage, an IND-ID-CPA adversary, A 1 against BasicHIBE is used to construct an IND-CPA
adversary A 2 against BasicPub (the same public key encryption scheme defined in the context
of Boneh-Franklin IBE). In the next stage, this A 2 is utilised to construct an algorithm B
that solves the BDH problem.
However, Gentry and Silverberg first prove the security in the non-adaptive setting and
later extend it to the adaptive setting. In the non-adaptive setting, A 1 a-priori fixes a target
identity v ∗ = (v1, ∗ . . . , vj), ∗ j ≥ 1. Given v ∗ , A 2 forms the H1 list in such a way that given any
identity v it can generate the private key of v, provided v is not a prefix of v ∗ . Similarly
in the challenge phase, it can generate a proper encryption of M γ under v ∗ , given a proper
encryption of M γ in BasicPub. This way, the advantage of A 1 against BasicHIBE can be
directly converted into the advantage of A 2 against BasicPub without any degradation.
The security reduction in the adaptive setting, however, suffers from a large degradation
factor. Let’s briefly see why this is so. Here, instead of a single identity, we have an identity
tuple of arbitrary levels. Recall that in the reduction for BasicIdent of Section 3.1, a typical
entry in H1 list is of the form 〈v, Q, b, c〉. In case of BasicHIBE an entry for v = (v 1 , . . . , v j )
is of the form 〈v i 〉, 〈Q vi 〉, 〈b i 〉, 〈c i 〉 where 1 ≤ i ≤ j, i.e., each 〈· · ·〉 contains j many entries,
whereas in case of BasicIdent of Section 3.1 they contained only a single term.
Let the target identity be v ∗ = (v1, ∗ . . . , vh ∗ ) then the corresponding entry in the Hlist 1 has
terms c 1 , . . . , c h ∈ {0, 1} h . So, instead of a single c, we have to maintain h many c i s in H1 list .
A 2 can generate a proper challenge ciphertext if and only if all these h c i s have the same
value, 1. But these c i s are chosen independently at random, so the probability that all are 1
is the product of the probabilities that each is 1. Hence, we get a security degradation which
is exponential in the number of levels in the target identity tuple.
Once A 2 has been constructed, either in the adaptive or the non-adaptive setting, the
next stage of the reduction is exactly that of Game 2 in case of Boneh-Franklin IBE. Finally,
in the adaptive setting one gets the following result:
Adv BasicHIBE
A 1
≤ (e × (q + h))h q H2
ɛ BDH
h
where e is the base of natural logarithm.
This means, if there is an IND-ID-CPA adversary A 1 in the adaptive setting having
advantage ɛ against BasicHIBE and that makes at most q H2 queries to H 2 and q private key
extraction queries and H 1 , H 2 are random oracles then there is an algorithm B that solves
the BDH problem with advantage at least (ɛ(h/e × (q + h)) h )q −1
H 2
, where h is the number
of levels in the target identity. So the security degrades exponentially with the number of
levels of the HIBE.
Applying the Fujisaki-Okamoto transformation to the BasicHIBE, Gentry and Silverberg
obtains an IND-ID-CCA secure HIBE which is called FullHIBE. The construction as well as
the security proof is analogous to that of FullIdent and not detailed here. Similarly, Galindo’s
observation [47] with respect to FullIdent is also applicable for the scheme FullHIBE.
24