Identity-Based Encryption Protocols Using Bilinear Pairing

The probability is over the independent and uniform random choices of x ′ 1, . . . , x ′ j, x 1 , . . . , x l
from Z m . Consequently, we have
[
]
Pr L θ (v θ) ′ j∧
= 0
(L k (v k ) = 0) = 1 ∣
m .
k=1
Proof : The proof is similar to the proof of Proposition 6.3.1. Without loss of generality,
we may assume that θ = j, since otherwise we may rename variables to achieve this. The
condition (L θ (v θ ′ ) = 0) ∧ ∧ j
k=1 (L k(v k ) = 0) is equivalent to a system of linear equations
xA = 0 over Z m . In this case, the form of A is the following.
[ ]
Ij c
A =
T O j×l
V l×j (v j) ′ T O l×l
where c = (0, . . . , 0, 1); c T denotes the transpose of c and (v ′ j) T is the transpose of v ′ j. The
first j columns of A are linearly independent. The (j + 1)th column of A is clearly linearly
independent of the first (j − 1) columns. We have v j ≠ v ′ j. Since each component of both v j
and v ′ j is less than 2 n/l and m > 2 n/l , we have v j ≢ v ′ j mod m. Using this, it is not difficult
to see that the first (j + 1) columns of A are linearly independent and hence the rank of A is
(j + 1). (Note that if m ≤ 2 n/l , then it is possible to have v j ≠ v ′ j but v j ≡ v ′ j mod m. Then
the jth and (j + 1)th columns of A are equal and the rank of A is j.) Consequently, the
dimension of the solution space is l − 1 and there are m l−1 solutions in (x ′ 1, . . . , x ′ j, x 1 , . . . , x l )
to the system of linear equations. Since the x ′ ’s and the x’s are chosen independently and
uniformly at random from Z m , the probability of getting a solution is m l−1 /m l+j = 1/m j+1 .
This proves the first part of the result. The proof of the second part is similar to that of
Proposition 6.3.1..
Proposition 6.3.3. The probability that the simulator in the proof of Theorem 6.3.1. does
not abort before the artificial abort stage is at least
1
2(2σ(µ l +1)) h .
Proof : We consider the simulator in the proof of Theorem 6.3.1. Up to the artificial
abort stage, the simulator could abort on either a key extraction query or in the challenge
stage. Let abort be the event that the simulator aborts before the artificial abort stage. For
1 ≤ i ≤ q, let E i denote the event that the simulator does not abort on the ith key extraction
query and let C be the event that the simulator does not abort in the challenge stage. We
have
[( q∧
) ]
E i
i=1
Pr[abort] = Pr
= Pr
[( q∧
i=1
E i
)
∧ C
|C
]
Pr[C]
73