Identity-Based Encryption Protocols Using Bilinear Pairing

3.4 HIBE with Shortened Ciphertext
3.4.1 Constant Size Ciphertext HIBE
Boneh, Boyen and Goh proposed a HIBE in the selective-ID model where the length of the
ciphertext is always constant. We refer to this protocol as BBG-HIBE. The construction is
described below.
Identities at a depth u are of the form (v 1 , . . . , v u ) ∈ (Z ∗ p) u . Messages are elements of G 2 .
Setup: Let 〈P 〉 = G 1 . Choose a random α ∈ Z p and set P 1 = αP . Choose random elements
P 2 , P 3 , Q 1 , . . . , Q h ∈ G 1 . Set the public parameter as PP = (P, P 1 , P 2 , P 3 , Q 1 , . . . , Q h )
while the master key is αP 2 .
Key-Gen:
and output
Given an identity v = (v 1 , . . . , v k ) ∈ (Z ∗ p) k of depth k ≤ h, pick a random r ∈ Z p
d v = (αP 2 + r(v 1 Q 1 , . . . , I k Q k + P 3 ), rP, rQ k+1 , . . . , rQ h ).
The private key for v can also be generated given the private key for v |k−1 as is the general
requirement of any HIBE.
Encrypt: To encrypt M ∈ G 2 under the identity v = (v 1 , . . . , v k ) ∈ (Z ∗ p) k , pick a random
s ∈ Z p and output
CT = (e(P 1 , P 2 ) s × M, sP, s(v 1 Q 1 + . . . + v k Q k + P 3 )) .
Decrypt: To decrypt CT = (A, B, C) using the private key d v = (a 0 , a 1 , b k+1 , . . . , b h ),
compute
A × e(a 1, C)
e(B, a 0 ) = M.
Note that, apart from the masked message, the ciphertext in BBG-HIBE consists of only
two elements of G 1 irrespective of the number of components in the corresponding identity.
In other HIBEs, the length of the ciphertext is proportional to the length of the identity tuple.
The BBG-HIBE offers new and important applications for constructing other cryptographic
primitives like forward secure encryption [26] and broadcast encryption [78, 38].
Security of BBG-HIBE against adaptive chosen plaintext attack is proved in the selective-
ID model under the h-wDBDHI ∗ assumptions described in Section 2.2.2. The security reduction
uses an algebraic technique similar to that of BB-HIBE. We do no provide the details of
the reduction. In Chapter 8 and Chapter 9 we augment the BBG-HIBE to stronger security
models with detailed argument about the reductions.
31