Identity-Based Encryption Protocols Using Bilinear Pairing

Key-Gen: Let v = (v 1 , . . . , v n ) ∈ {0, 1} n be any identity. A secret key for v is generated
as follows. Choose a random r ∈ Z ∗ p, then the private key for v is
where
Encrypt:
d v = (xP 2 + rV, rP ).
V = U ′ +
∑
{i:v i =1}
U i .
Any message M ∈ G 2 is encrypted for an identity v as
C = (e(P 1 , P 2 ) t M, tP, tV ),
where t is a random element of Z p and V is as defined in key generation algorithm.
Decrypt: Let C = (C 1 , C 2 , C 3 ) be a ciphertext and v be the corresponding identity. Then
we decrypt C using secret key d v = (d 1 , d 2 ) by computing
C 1
e(d 2 , C 3 )
e(d 1 , C 2 ) .
We give an intuitive understanding of the security reduction of this protocol. One of
the contributions of the present work is a generalisation of Waters construction. We give a
security proof of this generalised construction in Chapter 5.
Waters construction has some similarity with the BB-HIBE of Section 3.2. Using a
similar algebraic technique of Boneh-Boyen, Waters forms a simulator B, that solves the
DBDH problem given an adversary A against the IBE with advantage ɛ.
In the simulation, B constructs a function F : I → Z p , where I is the set of identities,
in such a way that given an identity v it can form a proper private key d v only if F (v) ≠
0. In contrast, it can form a proper challenge for an identity v ∗ only if F (v ∗ ) = 0. We
have already observed that this complementary condition for key generation and challenge
generation is a hallmark of all the encryption protocols described so far. Because of this
complementary condition there are certain identities for which the simulator cannot generate
the private key and for some other identities it is unable to generate a proper challenge. In
such situations, the simulator has to abort the game and we have no way to correlate the
adversarial advantage against the encryption protocol to that of solving the underlying hard
problem. This is the cause of degradation in the security reduction.
The complementary condition of key generation and target generation is also true for the
protocols secure under the selective-ID model. The simulator cannot generate the private
key of the target identity or any of its prefix. In sID model, however, we do not have any
security degradation because of the restriction of the model. The adversary commits to a
target identity ahead of the system setup. So the simulator chooses the system parameters
in such a way that it can answer all the key extraction queries of the adversary and also
generate the target ciphertext with probability one.
30