Identity-Based Encryption Protocols Using Bilinear Pairing

encryption of the message using the symmetric key sym.key. To decrypt, all that we need is
e(P 1 , P 2 ) t = e(d 1 , tP )/e(d 2 , tV ) and then find sym.key using H.
Security: Breaking the (modified) IBE implies either solving OBDH or breaking the
symmetric encryption scheme. The later we assume to be unbreakable under chosen ciphertext
attack. CCA security under the OBDH assumption is expressed in the following
theorem.
Theorem 5.4.1. The modified IBE protocol is (ɛ ibe , t, q)-IND-ID-CCA secure assuming that
the (t ′ , ɛ obdh )-OBDH assumption holds in 〈G 1 , G 2 , e〉, where ɛ ibe ≤ 2ɛ obdh /λ; t ′ = t + O(τq) +
χ(ɛ ibe ), where λ, χ(ɛ ibe ) and τ are as defined in Theorem 5.2.1.
Proof : (Brief sketch) Given a tuple 〈P, aP, bP, cP, str〉, the simulator B has to decide
whether str = H(cP, e(cP, bP ) a ) or str is random. The Setup and key-extraction queries
of both Phase 1 and 2 are just the same as that in the simulation of Theorem 5.2.1. of
Section 5.2.1. Whenever A places any decryption query C = 〈rP, rV, y〉, B queries the
oracle H a () with (rP, P 2 ) and decrypts y using whatever value the oracle returns.
In the Challenge phase, when A submits two messages M 0 , M 1 and an identity v ∗ , B
aborts if S would have aborted under v ∗ in the simulation part of Theorem 5.2.1.. Otherwise
B gives A the tuple C ′ = 〈cP, J(I ∗ )cP, y〉, where y is the encryption of M γ , γ ∈ {0, 1} using
str as the symmetric key. If str is random then C ′ gives no information about B’s choice of
γ. Otherwise C ′ is a valid encryption of M γ .
The rest of the simulation exactly mimics that of Theorem 5.2.1.
Use of OBDH assumption prevents the loss of one level in the conversion from CPA
security to CCA security and does not require any one time signature or MAC as in the
generic conversion discussed in Section 3.5. Using the endogenous technique of Boyen, Mei
and Waters [23] we can avoid this MAC or signature. However, it still requires a 2 level
HIBE. On the other hand, OBDH is a stronger assumption than DBDH.
5.5 Signature
It is an observation of Naor that any identity-based encryption scheme can be converted to
a signature scheme. Waters in his paper [89] has given a construction of a signature scheme
based on his IBE scheme. A similar construction is possible for the generalised scheme
IBE-SPP(l) which we detail here. The sketch of the security reduction is provided next.
Let G 1 = 〈P 〉, G 2 and e() be as defined in Section 2.1. Messages are assumed to be
elements of Z N where N = 2 n . Alternatively, if messages are assumed to be bit strings of
arbitrary length, then we use a collision resistant hash function to map the messages into
Z N .
Setup: Choose a random x in Z p and compute P 1 = xP . Next, choose from G 1 random
points P 2 , U ′ , U 1 , . . . , U l . The public key is 〈P, P 1 , P 2 , U ′ , U 1 , . . . , U l 〉 and the secret key is
xP 2 .
59