Identity-Based Encryption Protocols Using Bilinear Pairing

=
≥
(
(
1 − Pr
1 −
[( q∨
i=1
¬E i
)
|C
])
)
q∑
Pr [¬E i |C ] Pr[C].
i=1
Pr[C]
We first consider the event C. Suppose the challenge identity is v ∗ = (v1, ∗ . . . , vh ∗ ∗). Event
C holds if and only if F j (vj) ∗ ≡ 0 mod p for 1 ≤ j ≤ h ∗ . Recall that by choice of p, we can
assume F j (vj) ∗ ≡ 0 mod p if and only if x ′ j + ∑ l
k=1 x kv j,k = mk j . Hence,
[ h ∗
(
)]
∧
l∑
Pr[C] = Pr x ′ j + x k v j,k = mk j . (6.3.11)
j=1
For 1 ≤ j ≤ h ∗ and 0 ≤ i ≤ µ l , denote the event x ′ j + ∑ l
k=1 x kv j,k = mi by A j,i and the event
k j = i by B j,i . Also, let C j,i be the event A j,i ∧ B j,i .
Note that the event ∨ µ l
i=0 A j,i is equivalent to the condition x ′ j + ∑ l
k=1 x kv j,k ≡ 0 mod m
and hence equivalent to the condition L j (v j ) = 0. Since k j is chosen uniformly at random
from the set {0, . . . , µ l }, we have Pr[B j,i ] = 1/(1 + µ l ) for all j and i. The events B j,i ’s are
independent of each other and also independent of the A j,i ’s. We have
[ h ∗
(
)]
∧
l∑
Pr x ′ j + x k v j,k = mk j
= Pr
= Pr ⎣
[ h ∗
∧
⎡
= Pr ⎣
=
=
=
=
⎡
j=1
j=1
(
µl
k=1
)]
∨
C j,i
i=0
∨
i 1 ,...,i h ∗∈{0,...,µ l }
∨
i 1 ,...,i h ∗∈{0,...,µ l }
∑
i 1 ,...,i h ∗∈{0,...,µ l }
∑
i 1 ,...,i h ∗∈{0,...,µ l }
1 ∑
(1 + µ l ) h∗ ⎡
1
∨
Pr ⎣
(1 + µ l ) h∗
k=1
⎤
(C 1,i1 ∧ · · · ∧ C h ∗ ,i h ∗) ⎦
(A 1,i1 ∧ B 1,i1 ∧ · · · ∧ A h ∗ ,i h ∗ ∧ B h ∗ ,i h ∗) ⎦
Pr [A 1,i1 ∧ B 1,i1 ∧ · · · ∧ A h ∗ ,i h ∗ ∧ B h ∗ ,i h ∗]
Pr [A 1,i1 ∧ · · · ∧ A h ∗ ,i h ∗] × Pr [B 1,i1 ∧ · · · ∧ B h ∗ ,i h ∗]
i 1 ,...,i h ∗∈{0,...,µ l }
i 1 ,...,i h ∗∈{0,...,µ l }
Pr [A 1,i1 ∧ · · · ∧ A h ∗ ,i h ∗]
⎤
(A 1,i1 ∧ · · · ∧ A h ∗ ,i h ∗) ⎦
74
⎤