Anonymous Hierarchical Identity-Based Encryption ... - Unisinos

⋄ Setup :To create public parameters, the simulator B starts by drawing a tuple of random non-zero integers[ω, [α n , β n ] n=1,...,1+D ] ∈ $ (Z × p )3+2 D , and a vector of random integers [θ 0,l ] l=0,...,D ∈ $ (Z p ) 1+D .For each n = 1, . . . , 1+D, it also selects a vector of pairs of integers [θ n,l , ¯θ n,l ] l=0,...,D ∈ $ (Z p ) 2 (1+D) ,subject to the constraint that ∑ L ∗¯θ l=0 n,l Il ∗ = 0 (mod p), where it is noted that the elements withindices greater than L ∗ are left unconstrained. Next, the simulator assigns,[]Ω, [ a 0,l , b 0,l ] l=0,...,D ,← ⎢[ [ a n,l , b n,l ] l=0,...,D ] ⎣n=1,...,1+D⎡e(g, ĝ) ω , g θ 0,l1 , g θ 0,l2[ [(g θ n,lg ¯θ n,l1 ) αn , (g θ n,lg ¯θ ]n,l1 ) βn[]l=0,...,D ,l=0,...,D]n=1,...,1+DThe adversary is provided with the public parameters, Pub, which include the context G and theelements Ω and [[a n,l , b n,l ] l=0,...,D ] n=0,...,1+D ; their distribution is as in the real scheme.To complete the setup, the simulator computes what it can of the private key. Note that thepublic parameter simulation pegs the exponents α 0 and β 0 from the real scheme to the respectiveunknowns z 1 and z 2 implicitly defined by the Decision Linear instance. B partially computes themaster key, Msk, as, (except for the crossed-out vector of ŷ 0,·)[ŵ, [ â 0 , ˆb]0 , [——————ŷ 0,l ] l=0,...,D ],[ â n , ˆb←n , [ ŷ n,l ] l=0,...,D ] n=1,...,1+D⋄ Query :⎡⎣[ĝ ω ,[ĝ1 , ĝ 2 , [————————ĝ α ]0 β 0 θ 0,l] l=0,...,D ,ĝ αn , ĝ βn , [ (ĝ θ n,lĝ ¯θ n,l1 ) αn βn ] l=0,...,D]n=1,...,1+DIn the first probing phase, the adversary makes a number of extraction queries on adaptivelychosen identities distinct from Id ∗ and all its prefixes. Suppose that A makes such a query on Id =[I 0 , . . . , I L ] where I 0 = 1. To prepare a response, B starts by determining the identity componentof lowest index, L ′ , such that I L ′ ≠ IL ∗ , letting L ′ = L ∗ + 1 in the event that Id ∗ is a prefix of Id.′Under the stated rules of query, such an L ′ ∈ {1, . . . , D} always exists and is uniquely defined in saidinterval. The private key is constructed in two steps. In the first step, B creates a private key for theidentity Id ′ = [I 0 , . . . , IL ′ ]. Notice that Id′ is either equal to or a prefix of Id, but not of Id ∗ . DefineΘ 0 ← ∑ L ′l=0 θ 0,l I l . For n = 1, . . . , 1 + D, also define Θ n ← ∑ L ′l=0 θ n,l I l and ¯Θ n ← ∑ L ′¯θ l=0 n,l I l , andnote that all ¯Θ n ≠ 0 (mod p) except with negligible probability ≤ (1+D) /p over the choice of [¯θ n,l ].To proceed, B picks a tuple of random integers [˜ρ 0 , [˜ρ 0,m ] m=0,...,1+D ] ∈ $ (Z p ) 3+D , and, additionally,picks a random tuple [˜ρ n , [˜ρ n,m ] m=0,...,1+D ] ∈ $ (Z p ) 3+D for every n = 1, . . . , 1 + D. Moreover,B selects a supplemental collection of integers, [χ n , [χ n,m ] m=0,...,1+D ] n=1,...,1+D ∈ (Z p ) (3+D) (1+D) ,subject to certain constraints to be discussed later. The simulator creates the decryption portionof the prototype private key for Id ′ as,[]k 0 , [ k 0,(a) , k 0,(b) ],←[ k n,(a) , k n,(b) ] n=1,...,1+D⎡ŵ⎢⎣1+D∏n=1⎛⎝ ( ĝ −Θn/¯Θn2[â −˜ρnn() L ′Θ0 ˜ρ 0 ∏l=0ŷ I ln,l)˜ρ n⎞⎠,ĝ χn ˜ρ 0 Θ 0/¯Θn βn −˜ρn2 , ˆb n ĝ χn ˜ρ 0 Θ 0/¯Θn αn223[â −˜ρ 0 (1+D)0 , ˆb]−˜ρ 0 (1+D)0 ,]n=1,...,1+D⎤⎥⎦ ,⎤⎥⎦ .⎤⎦ .