Identity-Based Encryption Protocols Using Bilinear Pairing

F i (v ∗ i ) = α i P , so
C = 〈M γ · Z, cP, cF 1 (v ∗ 1), . . . , cF h ′(v ∗ h ′)〉.
If Z = e(P, P ) abc = e(P 1 , P 2 ) c then C is a valid encryption of M γ .
Phase 2: A makes additional queries which B answers just like Phase 1. Total number of
queries in Phase 1 and 2 together should not exceed q.
Guess: Eventually, A outputs its guess γ ′ of γ. If γ ′ = γ, B outputs 1, otherwise it outputs
0.
When Z = e(P, P ) abc , then A’s view in the above game is identical to that in a real
attack. In that case | Pr[γ = γ ′ ] − 1/2| ≥ ɛ. on the other hand if Z is a random element of
G 2 then Pr[γ = γ ′ ] = 1/2. Hence we get,
Adv DBDH
B ≥ ɛ.
In other words, if the (t, ɛ)-DBDH assumption holds in G 1 , G 2 then the h-HIBE of Boneh-
Boyen is (t ′ , q, ɛ)-IND-sID-CPA secure for arbitrary h and q and any t ′ < t − O(τhq) where
τ is the time for a scalar multiplication in G 1 .
3.3 Full Model
Boneh and Boyen were first to propose an IBE [18] whose proof of security in the full model
does not rely on the random oracle heuristic. The construction, however, is not very efficient
and as the authors observed, should be seen as a proof of concept. We reproduce their
construction because of its chronological importance.
Construction
Here the identities are elements of {0, 1} w . These identities are mapped to a random n bit
string through a hash function H k . H k is chosen from a family of hash functions {H k :
{0, 1} w → {0, 1} n } k∈K , where K is the key space for the family of hash functions.
Setup: Choose an arbitrary generator P ∈ G 1 , pick a random x ∈ Z p and set P 1 = xP .
Also choose a random element P 2 ∈ G 1 . Construct a random n×2 matrix U = (U i,j ) ∈ G1
n×2
where each U i,j is uniform in G 1 . Finally pick a random hash function key k ∈ K. The
public parameters are PP = 〈P, P 1 , P 2 , U, k〉 and the master key is msk = xP 2 .
Key-Gen: To generate the private key d v for an identity v ∈ {0, 1} w , compute −→ a =
H k (v) = a 0 , . . . , a n ∈ {0, 1} n and pick random r 1 , . . . , r n ∈ Z p . The private key is d v =
〈xP 2 + ∑ n
i=1 r iU i,ai , r 1 P, . . . , r n P 〉. Note that the private key consists of n + 1 elements of
G 1 .
28