Identity-Based Encryption Protocols Using Bilinear Pairing

Security
Given an identity tuple v = (v 1 , . . . , v j ), j ≤ h in H, the sender encrypts the message M to
a (j + 1) level identity ˆv = (Encode(v), (1vk)) of H ′ where vk is the verification key of the
underlying signature scheme. The receiver having identity v first derives the private key of
ˆv in H ′ from the private key d v in H using the key generation algorithm of H ′ . We assume
that the probability of forging a signature, Pr[Forge] is negligible. Then by a reductionist
security argument Boneh, Canetti, Halevi and Katz show that if there is an IND-sID-CCA
adversary A against H in the selective-ID model then one can construct an IND-sID-CPA
adversary A ′ against H ′ in the same model. Here we reproduce their argument:
1. A ′ runs the IND-sID-CCA adversary A which outputs a target identity tuple v ∗ =
〈v ∗ 1, . . . , v ∗ j〉, j ≤ h. A ′ next runs the key generation algorithm Key-Gen of Sig to
generate (vk ∗ , sk ∗ ). It outputs Encode(v ∗ ), (1vk ∗ ) as its target identity.
2. The challenger gives A ′ the public parameter PP, which it relays to A.
3. A asks for the private key of an identity v, which is not a prefix of v ∗ . A ′ asks its
challenger for the private key dˆv where ˆv = Encode(v) and returns it to A.
4. For a decryption query of the form (v, 〈vk, C, σ〉) from A, A ′ takes the following action:
(a) If v = v ∗ and vk = vk ∗ , return reject.
(b) If v ≠ v ∗ or if v = v ∗ but vk ≠ vk ∗ , then A ′ sets ˆv = Encode(v) and requests
its challenger for the private key of ˆv, (1vk). It decrypts the ciphertext using this
private key and returns the result to A.
5. In the challenge stage A outputs two messages M 0 , M 1 . The same messages are also
output by A ′ . It receives a challenge ciphertext C ∗ . Now A ′ computes σ ∗ = Sign sk ∗(C ∗ )
and returns the ciphertext 〈vk ∗ , C ∗ , σ ∗ 〉 to A.
6. In phase 2 A makes additional decryption queries and private key extraction queries.
These queries are answered as before.
7. Finally A outputs its guess γ ′ . The same γ ′ is output by A ′ .
In the above simulation, A ′ poses as a real challenger for A. Since we have assumed that
the probability of forging a signature is negligible, the advantage of A against H translates
into the advantage of A ′ against H ′ .
Note that, if H ′ is adaptive chosen plaintext secure in the full model (i.e., IND-ID-CPA
secure), then H will be adaptive chosen ciphertext secure (i.e., IND-ID-CCA secure) in the
full model.
Given this generic transformation to achieve CCA-security, protocol designers generally
concentrate on constructing protocols that achieve CPA-security (be it in the full model
or the selective-ID model) without random oracle and then apply this transformation to
34