Identity-Based Encryption Protocols Using Bilinear Pairing

=
=
=
[ h ∗
1 ∧
Pr
(1 + µ l ) h∗
1
(1 + µ l ) h∗ Pr
1
(m(1 + µ l )) h∗
j=1
[ h ∗
∧
j=1
(
µl
)]
∨
A j,i
i=0
(L j (v j ) = 0)
]
The last equality follows from Proposition 6.3.1.
Now we turn to bounding Pr[¬E i |C]. For simplicity of notation, we will drop the subscript
i from E i and consider the event E that the simulator does not abort on a particular key
extraction query on an identity (v 1 , . . . , v j ). By the simulation, the event ¬E implies that
L i (v i ) = 0 for all 1 ≤ i ≤ j. This holds even when the event is conditioned under C. Thus,
we have Pr[¬E|C] ≤ Pr[∧ j i=1 L i(v i ) = 0|C]. The number of components in the challenge
identity is h ∗ and now two cases can happen:
j ≤ h ∗ : By the protocol constraint (a prefix of the challenge identity cannot be queried to
the key extraction oracle), we must have a θ with 1 ≤ θ ≤ j such that v θ ≠ vθ ∗.
j > h ∗ : In this case, we choose θ = h ∗ + 1.
Now we have
[ j∧
Pr[¬E|C] ≤ Pr L i (v i ) = 0|C
i=1
]
≤ Pr[L θ (v θ ) = 0|C] = Pr
[
L θ (v θ ) = 0|
h ∗
∧
i=1
L i (v ∗ i ) = 0
]
= 1/m.
The last equality follows from an application of either Proposition 6.3.1. or Proposition 6.3.2.
according as whether j > h ∗ or j ≤ h ∗ . Substituting this in the bound for Pr[abort] we obtain
(
)
q∑
Pr[abort] ≥ 1 − Pr [¬E i |C ] Pr[C].
≥
≥
i=1
(
1 − q )
m
(
1 − q )
m
1
(m(µ l + 1)) h∗
1
(m(µ l + 1)) h
≥ 1 2 × 1
(2σ(µ l + 1)) h .
We use h ≥ h ∗ and 2q ≤ σ < m < 2σ to obtain the inequalities. This completes the proof.
6.4 Conclusion
In this chapter, we have presented a construction of a HIBE which builds upon the previous
IBE protocols. The HIBE is secure in the full model without random oracle. The number
75