In identity-based encryption (IBE) the public key of a user $A$ is some identity string $ID_A$, e.g., an email address. To encrypt a message for this user there is no need to retrieve an authentic copy of the public key, as it is in public key cryptography, but one can simply use the identity string ...

learn more… | top users | synonyms

7
votes
1answer
226 views

What is the “artificial abort” technique?

In the security proof of Brent Waters's paper Efficient Identity-Based Encryption Without Random Oracles, he uses a novel “artificial abort” step on page 6. At this point the simulator is still ...
4
votes
3answers
450 views

How to prove identity without revealing identity

Let us say Alice publishes a book under the name of Claire. The book becomes wildly popular and now Bob comes along, claiming to be Claire, to reap all the success. How does Alice prove that she wrote ...
4
votes
3answers
1k views

Is there any semantic difference between predicate encryption and functional encryption?

Predicate encryption(PE) arrived as a descendant of attribute based encryption. Attribute based encryption allows the encryptor to embody a policy to the ciphertext (Ciphertext-Policy based ...
4
votes
2answers
103 views

How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
4
votes
3answers
371 views

What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it

I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
4
votes
1answer
155 views

Generic group model: use of polynomials in the proof of the master theorem

I've been looking at the paper of Boneh, Boyen, Goh Hierarchical Identity Based Encryption with Constant Size Ciphertext which contains a general theorem (Theorem A.2) about the advantage of an ...
3
votes
1answer
95 views

Question on Waters IBE

I'm reading “Efficient Identity-Based Encryption Without Random Oracles” by Brent Waters. In Page 9, I don't know how ...
3
votes
1answer
48 views

Identity-based proxy re-encryption using different system parameters

I am wondering if there is an identity based proxy re-encryption scheme (such as the Green-Ateniese scheme https://eprint.iacr.org/2006/473.pdf) that converts an encryption computed with ID1, system ...
2
votes
2answers
239 views

What is “msg = group.random(GT)” in Charm encryption schemes?

In many encryption schemes in Charm the random group message is used instead of a text-message: msg = group.random(GT) For example, in CP-ABE scheme, random ...
2
votes
1answer
607 views

what's the advantages of identity-based systems over certificate-based ones?

Actually, I'm not familiar to how identity-based and certificate-based systems work, so ,can anyone give me a detail and comprehensive answer to this question? Moreover, in what environments the ...
2
votes
1answer
241 views

Pairings in Identity-based encryption vs. Attribute-based encryption

The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and ...
2
votes
1answer
183 views

a possibly stronger type of attack on identity-based encryption

What is known about the security of identity-based encryption schemes against attacks that involve seeing multiple ciphertexts and then receiving the private keys corresponding to some of those ...
2
votes
1answer
86 views

Decryption of message in IBE without random oracle using bilinear pairing registration?

I find the following IBE scheme from the videos posted and i don't understand the decryption algorithm, will any one please elaborate the 6th step scheme Setup($\lambda$) : $(\mathbb{G}, ...
2
votes
1answer
137 views

Question about dual system encryption

Recently, I have been reading some dual system encryption papers. In these systems, is the adversary able to generate “semi-functional ciphertexts”?
2
votes
2answers
137 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
2
votes
0answers
51 views

User revocation in Identity Based Encryption

I read several papers about user revocation in IBE recently. A common point is that when a user is revoked, some other valid users should also update their private keys. Does this mean that one ...
2
votes
0answers
341 views

How does identification currently work with the German identity card? [closed]

Since 18th of December 2010 Germany makes use of an identity card that should allow electronic authentication: (image source: commons.wikipedia.org) From a users perspective, the authentication ...
1
vote
1answer
47 views

Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
1
vote
1answer
402 views

what is the difference between IBE and ABE schemes

Can somebody explain in simple words. real life example light help and limitations of these schemes etc.
1
vote
2answers
505 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
1
vote
1answer
35 views

Do any Identity-based Encryption Systems support messaging between domains?

Identity Based Encryption is covered under RFC 5091 (specifying the algorithm), 5408 (specifying data structures), and 5409 (using IBE with Cryptographic Message Syntax). However, every IBE ...
1
vote
1answer
87 views

Cocks IBE Scheme: why is -a a quadratic residue mod n?

In the Cocks IBE scheme it is required for the hash function, that the Jacobi symbol of its output and the universally available moduls $n = p*q$ is $+1$, so: $\Big(\frac{H(ID)}{n}\Big) = ...
1
vote
1answer
58 views

Use of the master key in Delerablée's Identity-based Broadcast Encryption

I'm reading “Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys” by Cécile Delerablée. On page 207, the encryption process needs $\gamma$ which is part of the master ...
1
vote
1answer
260 views

Is it feasible to use combination of ABE schemes for encrypting the data?

I have a peculiar requirement for preserving the shared log files. For example I have 1000 records which belong to different organizations as listed below and all the logs are present in a single CSV ...
1
vote
2answers
122 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper (archive link). The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod ...
1
vote
0answers
129 views

Example describing Baek and Zheng’s threshold identity-based decryption scheme

I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ...
1
vote
0answers
105 views

How to compare different signature scheme's performance?

I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair ...
1
vote
0answers
116 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
0
votes
2answers
74 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
0
votes
1answer
31 views

Subscript R notation for the finite fields

I'm trying to understand the notation used in the literature for Pairing-based cryptography. I know (and I hope I've understood it well) from Wikipedia that $\mathbb{Z}_p$ is the finite field of ...
0
votes
1answer
33 views

Possibility for same Private Key Generation in identity-based encryption

In private key generation of IBE scheme, private key is generated as follows: $SK_{ID}=s.H(ID)$ Suppose two servers use the same curve domain parameters. If PKG on server A generates private key ...
0
votes
1answer
116 views

Identity-Based Encryption consist of four algorithms. Extract phase is one of them and it is done by PKG or receiver?

The Identity-Based Encryption consist of four randomized algorithms: Setup, Extract, Encrypt, Decryption. The Setup phase is done by Private-key generator, Encrypt by sender and Decryption by ...
0
votes
1answer
24 views

How to run a (provably probably) secure global referendum?

The following question is extremely broad and speculative, for which I apologize, but it strikes me as exceedingly important, so I will ask it nonetheless. Suppose an event of global significance ...
0
votes
1answer
21 views

Probability of generating same master secret key in Identity-based Encryption

Suppose multiple servers use same IBE domain parameters (I mean same curve description parameters and field) for master secret key setup. Is there any possibility for generating the same system ...
0
votes
0answers
16 views

Security Level Same or not in key extraction of identity-based encryption

In identity-based encryption, key generation is performed using ($s$) as a secret key for identity a as in (eq.1) $\bullet$ $Priv_{a}=s.H(ID_{a})$(eq.1) If key is generated as follows, $\bullet$ ...
0
votes
0answers
27 views

Security for this scheme or not in pairing

Let be $G_{1}$and $G_{2}$ cyclic groups of prime order $q$ and $g =<G1>$ and $h=<G2>$ the generators of these groups. Let's consider the following protocol: Select $s \leftarrow ...
0
votes
0answers
14 views

Does the user need to know how the decryption scheme works in identity-based broadcast encryption [duplicate]

For example, in Delerablee's identity-based broadcast encryption scheme, decryption scheme is defined as $E(C_1,h^P)$ $E(\mathcal{SK}_{id},C_2)$. Are the users allowed to know how decryption works? ...
0
votes
0answers
18 views

Do users need to know decryption scheme in Identity-based broadcast encryption?

I have a question related to identity-based broadcast encryption: For decryption, there are different decryption schemes. Does the user need to know that scheme, or does the system firmly define the ...
0
votes
2answers
42 views

How to define order according to domain parameters in elliptic curve pairing groups

According to domain parameters, as an example Type 1 pairing domain parameters are ...
0
votes
0answers
58 views

Identification schemes: Okamoto

I am reading Cryptography theory and practice by Stinson. The book is talking about the proof of security of Schnorr and Okamoto schemes. It claims that if an impersonater can find (in the case of the ...
0
votes
0answers
43 views

Is Attribute based encryption sub-class of Identity based encryption [duplicate]

I have a basic question related to Identity and Attribute based encryption. Construction of IBE scheme was first shown by Boneh et al. in 2001 and I think in 2004 Sahai and Waters introduced ...
-1
votes
0answers
22 views

Does security exists in this pairing-based encryption scheme [duplicate]

Consider G1,G2 be cyclic group of prime order p. g =generator of G1 ,G1=generator of G2 public key PK=g^s Assume (PK,g1,p) is made public. x←1,,2,...,p y←1,,2,...,p Private key for user a=x Private ...