Identity-Based Encryption Protocols Using Bilinear Pairing

Signing: Let M = (m 1 , m 2 , . . . , m l ) is the message to be signed, where each m i , 1 ≤ i ≤ l
is a bit string of length n/l. To generate a signature on M, first choose a random r ∈ Z ∗ p.
Then the signature is
σ M = (xP 2 + rV, rP ),
where V = U ′ + ∑ l
i=1 m iU i
Verification: Given a message M = (m 1 , m 2 , . . . , m l ) and a signature σ = (σ 1 , σ 2 ) on M,
one accepts σ as a valid signature on M if
where V = U ′ + ∑ l
i=1 m iU i .
5.5.1 Security
e(σ 1 , P ) = e(P 1 , P 2 )e(σ 2 , V )
The security of the above signature scheme can be reduced from the hardness of the DBDH
problem. In fact, using the same argument, we can show that the reduction in Theorem 5.2.1.
also holds for this signature scheme. Moreover, the forged signature that the adversary
returns can be used to break the computational Diffie-Hellman problem (CDH) in G 1 . The
CDH problem in G 1 is: given a tuple 〈P, aP, bP 〉, compute abP . The success probability of
an adversary B in solving the CDH problem in G 1 is defined as
Succ CDH
B = Pr[B(P, aP, bP ) = abP ]
where the probability is calculated over the random choice of a, b ∈ Z p as well as the random
bits used by B. Let (Adv SIG (t, q) in this context denote the maximum advantage where the
maximum is taken over all adversaries running in time t and making at most q queries.
Theorem 5.5.1. For t ≥ 1, q ≥ 1; Adv SIG (t, q) ≤ (2/λ)Succ CDH (t + O(τq)), where messages
are chosen from Z N and 1 < l ≤ lg N is a size parameter.
Proof : Brief sketch: This proof also is a reduction. Suppose A is a CPA adversary for
the signature scheme. Then we construct an algorithm S for Computational Diffie-Hellman
problem (CDH). S will take as input a 3-tuple 〈P, aP, bP 〉 where P is a generator of G 1 and
aP, bP ∈ G 1 . We define the following game between S and A.
The Setup and Signature Generation steps of this game is exactly same as the Setup and
Phase 1 in the simulation part of Theorem 5.2.1.
Forge: At this stage the adversary A submits a message M ∗ ∈ Z N and a signature
σ ∗ = (σ ∗ 1, σ ∗ 2) with the constraint that it has not asked for the signature of M ∗ in the
Signature Generation phase. A wins if σ ∗ is a valid signature on M ∗ .
60