Identity-Based Encryption Protocols Using Bilinear Pairing

Decrypt: Let C = (C 1 , C 2 , C 3 ) be a ciphertext and v be the corresponding identity. Then
we decrypt C using secret key d v = (d 1 , d 2 ) by computing
C 1 × e(d 2, C 3 )
e(d 1 , C 2 ) = e(P 1, P 2 ) s e(rP, sV )
× M
e(xP 2 + rV, sP ) = M
Note that, for l = n this is exactly Waters protocol. For l = 1, some minor modifications
in the above scheme give a protocol where the additional requirement in the public parameter
is just a single element of G 1 as described below.
IBE-SPP(1)
Setup: Randomly choose a secret x ∈ Z N . Set P 1 = xP , then choose P 2 ∈ G 1 at random.
Further, choose a random element U ′ ∈ G 1 . The master secret is xP 2 whereas the public
parameters are 〈P, P 1 , P 2 , U ′ 〉.
Key-Gen: Let v be any identity. A secret key for v is generated as follows. Choose a
random r ∈ Z ∗ p, then the private key for v is
d v = (xP 2 + rV, rP ).
where V = U ′ + vP 2 .
Here the Encrypt and Decrypt algorithms are same as IBE-SPP(l) with the modified definition
of V . Note that, this is essentially the Boneh-Boyen HIBE of Section 3.2.1 restricted
to IBE in the adaptive-ID model.
Efficiency: Consider IBE-SPP(l) with 1 < l ≤ n. Let cost(V ) be the cost of computing V .
The cost of key generation is two scalar multiplications over G 1 plus cost(V ). By including
e(P 1 , P 2 ) instead of P 1 , P 2 in the public parameter, we can avoid the pairing computation
during encryption. So the cost of encryption is one exponentiation over G 2 , two scalar multiplications
over G 1 plus cost(V ). The cost of decryption is two pairings, one multiplication
and one inversion over G 2 . The effect of l is in cost(V ) and affects key generation and
encryption costs but does not affect decryption cost.
We first consider the costs of scalar multiplication over G 1 and exponentiation over G 2 .
As mentioned earlier, G 1 is an elliptic curve group. Let IF a denote the base field over which
G 1 is defined. Then G 2 is a subgroup of IF k a, where k is the MOV degree. Additions and
doublings over G 1 translate into a constant number of multiplications over IF a . The actual
number is slightly different for addition and doubling, but we will ignore this difference. Let
|IF a | be the size of the representation of an element of IF a . Assuming the cost of multiplication
over G 1 is approximately equal to |IF a | 2 , the cost of a scalar multiplication over G 1 is equal
to c 1 |IF a | 3 for some constant c 1 . One can also show that the cost of exponentiation over G 2
51