and the re-randomization portion as, for all m = 0, . . . , 1 + D,[]f m,0 , [ f m,0,(a) , f m,0,(b) ],←[ f m,n,(a) , f m,n,(b) ] n=1,...,1+D⎡⎢⎣1+D∏n=1⎛⎝ ( ĝ −Θn/¯Θn2[â −˜ρn,mn() L ′Θ0 ˜ρ 0,m ∏l=0ŷ I ln,l)˜ρ n,m⎞⎠,ĝ χn,m ˜ρ 0,m Θ 0/¯Θn βn −˜ρn,m2 , ˆb n ĝ χn,m ˜ρ 0,m Θ 0/¯Θn αn2and also the delegation portion as, for all l = 1 + L ′ , . . . , D,[]h l ,←[ h m,l ] m=0,...,1+D[ 1+D ∏(ŷ n,l ) ρn ,n=0[â −˜ρ 0,m (1+D)0 , ˆb]−˜ρ 0,m (1+D)0,]n=1,...,1+D[ 1+D]∏(ŷ n,l ) ρn,mn=0m=0,...,1+DOnce this is done, the second step for B is, starting with the prototype private key for Id ′ calculatedabove, to apply the Derive algorithm iteratively to obtain private keys for the sequence of identitiesId k = [I 0 , . . . , I k ] as k is incremented from L ′ + 1 to L. The end result is a private key Pvk Id for therequested identity Id = [I 0 , . . . , I L ]. The simulator B gives this key to A in response to the query.According to Theorem 5, the returned key for Id will be correctly distributed whenever the keyfor Id ′ is. To see that the prototype key is indeed distributed correctly, we make the followingchange of variables, for all n = 1, . . . , 1 + D, and m = 0, . . . , 1 + D,ρ 0 = ˜ρ 0 (1 + D) ,ρ n = ˜ρ n − χ nz 2 ˜ρ 0 Θ 0¯Θ n α n β n,ρ 0,m = ˜ρ 0,m (1 + D) ,ρ n,m = ˜ρ n,m − χ n,mz 2 ˜ρ 0,m Θ 0¯Θ n α n β n,which lets us rewrite the various components in their usual form. In extenso,⎛1+D∏k 0 = ŵ ⎝ ( () L ′ )˜ρ n⎞−1 Θ0 ˜ρ−Θn ¯Θ 0 ∏nĝ ⎠= ŵ= ŵ(= ŵ(= ŵ(= ŵn=11+D∏n=11+D∏n=1⎛⎜⎝(ĝ⎛⎝ ( ĝĝ −˜ρ 0 Θ 02ĝ −˜ρ 0 Θ 02ĝ −˜ρ 0 Θ 022−1−Θn ¯Θ n2−1−Θn ¯Θ n2l=0() L ′Θ0 ˜ρ 0 ∏) Θ0 ˜ρ 0(l=0ĝ Θn2) P 1+D−1n=1 (χn−1) Θn ¯Θ) P 1+D−1n=1 (χn−1) Θn ¯Θŷ I ln,l(ĝ θ n,lĝ ¯θ n,l1 ) I l)χ n z 2 ˜ρ 0 Θ 0 ¯Θ−1 n ( L ′∏l=0) χn ˜ρ 0 Θ ¯Θ−1 0( )nĝ z χn ˜ρ1 z 2 ¯Θ 0 Θ ¯Θ−1 0 nn⎛∏⎝(ĝ z 1 z 2) χn ˜ρ 0n 1+Dn=1⎛∏⎝n 1+Dn=1) P (1+D−1 L ′n=1 (χn−1) Θn ¯Θ n ∏l=0( L ′∏(ĝ α 0 β 0 θ 0,l) I l(P L′L ′∏l=0 θ 0,l I ll=0)χ n ˜ρ 0 ( L ′ŷ I ln,l∏l=0l=0) P 1+Dn=1 χn/(1+D) 1+D L ′ŷ I l ρ 00,l24∏ ∏n=1 l=0)ρ n⎞( L ′ŷ I ln,l∏⎟⎠ŷ I ln,ll=0)ρ n⎞ŷ I ln,lŷ I l ρ nn,l⎠])ρ n⎞= ŵ.⎤⎥⎦ ,)ρ n⎞⎠1+D∏⎠∏L ′n=0 l=0ŷ I l ρ nn,l,
where the last equation is predicated on the two following conditions,1+D∑n=1(χ n − 1) = 0 ,1+D∑n=1(χ n − 1) Θ n ¯Θ−1 n = 0 ; (1a,1b)and as required, we find that k 0,(a) = â −ρ 00 and k 0,(b) = ˆb −ρ 00 ; and also, for n = 1, . . . , 1 + D,k n,(a) = â −˜ρnnk n,(b) =ˆb−˜ρnnĝ χn ˜ρ 0 Θ 0/¯Θn βn2 = ân−ρn ĝ −αn χn z 2 ˜ρ 0 Θ 0/¯Θn αn βnĝ χn ˜ρ 0 Θ 0/¯Θn βn2 = â −ρnĝ χn ˜ρ 0 Θ 0/¯Θn αn2 =ˆb−ρnnn ,ĝ −βn χn z 2 ˜ρ 0 Θ 0/¯Θn αn βnĝ χn ˜ρ 0 Θ 0/¯Θn αn −ρn2 = ˆb n .Using analogous calculations, we can derive a similar set of relations, such as, for m = 0, . . . , 1 + D,⎛1+D∏f m,0 = ⎝ ( () L ′ )˜ρ n,m⎞−1 Θ0 ˜ρ−Θn ¯Θ 0,m ∏nĝ ⎠(==n=12ĝ −˜ρ 0,m Θ 021+D∏∏L ′n=0 l=0l=0ŷ I ln,l) P (1+D−1 L ′n=1 (χn,m−1) Θn ¯Θ n ∏ŷ I l ρ n,mn,l,l=0ŷ I l ρ 0,m0,l) P 1+Dn=1 χn,m/(1+D) 1+D L ′where for the last equality to hold we impose that, for all m = 0, . . . , 1 + D,∏ ∏n=1 l=0ŷ I l ρ n,mn,l1+D∑n=1(χ n,m − 1) = 0 ,1+D∑n=1(χ n,m − 1) Θ n ¯Θ−1 n = 0 ; (2a,2b)in addition, we have the required f m,0,(a) = â −ρ 0,m0 and f m,0,(b) = ˆb −ρ 0,m0 ; and furthermore, for alln = 1, . . . , 1 + D,f m,n,(a) = â −˜ρn,mnf m,n,(b) =ˆb−˜ρn,mnĝ χn,m ˜ρ 0,m Θ 0/¯Θn βn2 = ân−ρn,mĝ −αn χn,m z 2 ˜ρ 0,m Θ 0/¯Θn αn βnĝ χn,m ˜ρ 0,m Θ 0/¯Θn βn2 = ân −ρn,m,ĝ χn,m ˜ρ 0,m Θ 0/¯Θn αn2 =ˆb−ρn,mnĝ −βn χn z 2 ˜ρ 0,m Θ 0/¯Θn αn βnĝ χn,m ˜ρ 0,m Θ 0/¯Θn αn −ρn,m2 = ˆb n .As for the remaining components of the key, if, for each l = 1+L ′ , . . . , D, and each m = 0, . . . , 1+D,1+D∑n=1χ n¯θn,l¯Θ n1α n β n= (1 + D) θ 0,lΘ 0,1+D∑n=1χ n,m¯θn,l¯Θ n1α n β n= (1 + D) θ 0,lΘ 0, (3,4)25
- Page 1 and 2: This paper is available from the IA
- Page 3 and 4: invertible homomorphism, etc.). To
- Page 5 and 6: Informally, we say that an assumpti
- Page 7: 4 A Primer : Anonymous IBEWe start
- Page 10 and 11: Setup(1 Σ , D) To generate the pub
- Page 12 and 13: Encrypt(Pub, Id, Msg) To encrypt a
- Page 14 and 15: [9] Dan Boneh, Xavier Boyen, and Ho
- Page 16 and 17: Threshold. It is a known result [8]
- Page 18 and 19: Proof of Theorem 6. We prove the th
- Page 20 and 21: On the other hand, we have, for l =
- Page 22 and 23: CT ∗ real = [E, c 0, [c 0,(a) , c
- Page 26 and 27: then, we can equate, for every l =
- Page 28: This concludes the description of t