Download Full Issue in PDF - Academy Publisher

1622 JOURNAL OF COMPUTERS, VOL. 8, NO. 6, JUNE 2013
sets rk ID→ID ′ = x and returns it to A. He
computes w = (gH 1 (ID) h) x
and sends it to the
(g H 1 (ID) h)
proxy. We observe that
rk 1 = αID′ + t 2 + k 1
k 3 (αID + t 2 ) + k 2
but from the simulation, α = a and t 2 = α ′ −
aID ∗ , so we can get
rk 1 = aID′ + α ′ − aID ∗ + k 1
k 3 (aID + α ′ − aID ∗ ) + k 2
Let rk 1 = x, we can get
k 1 = k 3 (aID + α ′ − aID ∗ )(x − k 2 )
−(aID ′ + α ′ − aID ∗ )
= [k 3 (x − k 2 )a(ID − ID ∗ )
−a(ID ′ − ID ∗ )] + k 3 α ′ (x − k 2 ) − α ′
So the challenge B simulates as follows. He
chooses a randomly k 2 , k 3 ∈ Z ∗ p, sets
x =
ID′ − ID ∗
k 3 (ID − ID ∗ ) + k 2,
k 1 = α ′ ( ID′ − ID ∗
ID − ID ∗ ) − α′
searches in User-key-list
for item (ID ′ , α ′ , r, r ′ )(we assume
sk ID ′ = (d 0 , d 1 , d ′ 0) =
−α ′
−1
ID ′ −ID ∗
ID
(g
′ −ID ∗
2 (g (ID′ −ID ∗ )
1 g a ) r , g2 g r ,
−α ′
ID
g
′ −ID ∗
2 (g (ID′ −ID ∗ )
1 g a ) r′ ) and computes
rk 1 =
rk 2 = g
ID ′ − ID ∗
k 3 (ID − ID ∗ ) + k 2,
−k 3
ID ′ −ID ∗
2 g k3r′
−k 2 k 3
ID ′ −ID ∗
rk 3 = g2 g k2k3r′ ,
α ′ ( ID′ −ID ∗
ID−ID ∗ )−α′
ID
rk 4 = g
′ −ID ∗
2 g (α′ ( ID′ −ID ∗
ID−ID ∗ )−α ′ )r ′
returns them to A. We can see
C ′ 3e(rk 2 , C ′ 4)
e(C ′ 2 , rk 3)e(C ′ 1 , rk 4)e(d ′ 0 , C′ 1 )
can be reduced to
Me(g 1 , g 2 ) r
e(g α 2 , gr )
= M
Thus our simulation is indistinguishable from
the real algorithm running. Thus our simulation
is indistinguishable from the real algorithm
running.
• “A issues up to re-encryption queries on
(C ID , ID, ID ′ )”. The challenge B runs
ReEnc(rk ID→ID ′, C ID , ID, ID ′ ) and returns
the results.
4) Challenge When A decides that Phase1 is over,
it outputs two messages M 0 , M 1 ∈ G. Algorithm
B picks a random bit b and responds with the
ciphertext C = (g c , (g α′ ) c , M b · T ). Hence if T =
e(g, g) abc = e(g 1 , g 2 ) c , then C is a valid encryption
of M b under ID ∗ . Otherwise, C is independent of
b in the adversary’s view.
5) Phase2 A issues queries as he does in Phase 1
except natural constraints.
6) Guess Finally, A outputs a guess b ′ ∈ {0, 1}.
Algorithm B concludes its own game by outputting
a guess as follows. If b = b ′ , then B outputs 1
meaning T = e(g, g) abc . Otherwise it outputs 0
meaning T ≠ e(g, g) abc .
When T = e(g, g) abc then A’s advantage for breaking
the scheme is same as B’s advantage for solving DBDH
problem.
Theorem 2: Suppose the DBDH assumption holds,
then our scheme proposed in Section III-C is DGE-
IBE-IND-sID-CPA secure for the delegator and proxy’s
colluding.
Proof: The security proof is same as the above
theorem except that it does not allow “A issues up to
rekey generation queries on (ID, ID ∗ )”, for B does not
know the private key corresponding to ID ∗ .
Theorem 3: Suppose the DBDH assumption holds,
then our scheme proposed in Section III-C is PKG-OW
secure for the delegator, delegatee and proxy’s colluding.
Proof: We just give the intuition for this
theorem. The master-key is g2 α , and delegator’s private
key is sk ID = (g2 α (g1 ID h) u0 , g u0 , (g2 α (g1 ID h) u1 )),
the delegatee’s private key is sk ID ′ =
(g2 α (g1 ID′ h) u0 , g u0 , (g2 α (g1 ID′ h) u1 )) , the proxy reencryption
key is rk ID→ID ′ = ( αID′ +t 2+k 1
k 3(αID+t 2)
+
k 2 , g u′ 1 k3 , g u′ 1 k2k3 , g u′ 1 k1 ). Because the re-encryption key
rk ID→ID ′ is uniformly distributed in (Zp, ∗ G, G, G), and
the original BB 1 IBE is secure, we can conclude that
g2
α can not be disclosed by the proxy, delegatee and
delegator’s colluding.
E. Toward Chosen Ciphertext Security
As we all know, just considering IND-sID-CPA security
is not enough for many applications. We consider
construct IND-Pr-ID-CCA secure IBPRE based on a
variant of BB 1 IBE. There are two ways to construct
IND-Pr-ID-CCA secure IBPRE. One way is considering
CHK transformation to hierarchal variant of BB 1 IBE
to get IND-Pr-sID-CCA secure IBPRE or get IND-Pr-
IDKEM-CCA secure IBPRE. The other way is considering
variant of BB 1 IBE in the random oracle model.
From a practical viewpoint, we construct an IND-Pr-ID-
CCA secure IBPRE based on a variant of BB 1 IBE in
the random oracle model.
F. Our Proposed IND-Pr-ID-CCA Secure IBPRE Scheme
Based on a Variant of BB 1 IBE
Let G be a bilinear group of prime order p(the security
parameter determines the size of G). Let e : G × G →
G 1 be the bilinear map. Identities are represented using
distinct arbitrary bit strings in {0, 1} l . The messages (or
© 2013 ACADEMY PUBLISHER