Identity-Based Encryption Protocols Using Bilinear Pairing

is equal to c 2 |IF a | 3 . Thus, the total cost of scalar multiplication and exponentiation is equal
to c|IF a | 3 .
The cost of computing V amounts to computing l scalar multiplications where each
multiplier is an (n/l)-bit string. On an average, the cost of each such multiplication will be
n/2l additions and (n/l − 1) doublings over G 1 . Hence, the total cost of computing V is
n/2 additions and (n − l) doublings over G 1 . This cost is equal to d(3/2 − l/n)n|IF a | 2 for
some constant d.
We consider the cost of encryption. The total cost is
c|IF a | 3 + d(3/2 − l/n)n|IF a | 2 =
(
c + d ×
n
|IF a |
( 3
2 − l n
))
|IF a | 3 . (5.2.1)
This cost is minimum when l = n (as in Waters protocol). The maximum value of the
coefficient of |IF a | 3 is (c + (3nd)/(2|IF a |)) whereas the minimum value is (c + (nd)/(2|IF a |)).
The value of |IF a | is usually greater than n and hence the value of (nd)/(2|IF a |) will be a small
constant and hence there is not much effect of l on the total cost of encryption. A similar
analysis shows that the effect of l is also not very significant on the cost of key generation.
We note, however, that key generation is essentially a one-time offline activity.
5.2.1 Security Reduction
The security (in the sense of IND-ID-CPA) of the identity-based encryption scheme developed
above (i.e., IBE-SPP(l)) can be reduced from the hardness of the DBDH problem as stated
in the following theorem.
Theorem 5.2.1. The IBE protocol described in Section 5.2 is (ɛ ibe , t, q)-IND-ID-CPA secure
assuming that the (t ′ , ɛ dbdh )-DBDH assumption holds in 〈G 1 , G 2 , e〉, where ɛ ibe ≤ 2ɛ dbdh /λ;
t ′ = t + O(τq) + χ(ɛ ibe ) and
χ(ɛ) = O(ɛ −2 ln(ɛ −1 )λ −1 ln(λ −1 ));
τ is the time required for one scalar multiplication in G 1 ;
λ = 1/(8q(µ l + 1)) with µ l = l(N 1/l − 1), N = 2 n .
Proof : Suppose A is a (t, q, ɛ ibe )-IND-ID-CPA adversary for IBE-SPP(l). Then we construct
an algorithm S for DBDH running in time (t + O(τq) + χ(ɛ ibe )) such that, ɛ ibe ≤ 16q(µ l +
1)ɛ dbdh , where µ l = l(N 1/l − 1). S will take as input a 5-tuple 〈P, aP, bP, cP, Z〉 where P is
a generator of G 1 , aP, bP, cP ∈ G 1 and Z ∈ G 2 . We define the following game between S
and A.
Setup: S first chooses random x, x 1 , . . . , x l ∈ Z m where m < 4q is a prime; random
y, y 1 , . . . , y l ∈ Z p and a random k ∈ {0, . . . , µ l }. It then defines three functions: F (v) =
52