In identity-based encryption (IBE) the public key of a user $A$ is some identity string $ID_A$, e.g., an email address. To encrypt a message for this user there is no need to retrieve an authentic copy of the public key, as it is in public key cryptography, but one can simply use the identity string ...

learn more… | top users | synonyms

7
votes
1answer
231 views

What is the “artificial abort” technique?

In the security proof of Brent Waters's paper Efficient Identity-Based Encryption Without Random Oracles, he uses a novel “artificial abort” step on page 6. At this point the simulator is still ...
4
votes
3answers
520 views

How to prove identity without revealing identity

Let us say Alice publishes a book under the name of Claire. The book becomes wildly popular and now Bob comes along, claiming to be Claire, to reap all the success. How does Alice prove that she wrote ...
4
votes
3answers
1k views

Is there any semantic difference between predicate encryption and functional encryption?

Predicate encryption(PE) arrived as a descendant of attribute based encryption. Attribute based encryption allows the encryptor to embody a policy to the ciphertext (Ciphertext-Policy based encryption)...
4
votes
2answers
125 views

How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
4
votes
3answers
384 views

What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it

I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows per-...
4
votes
1answer
172 views

Generic group model: use of polynomials in the proof of the master theorem

I've been looking at the paper of Boneh, Boyen, Goh Hierarchical Identity Based Encryption with Constant Size Ciphertext which contains a general theorem (Theorem A.2) about the advantage of an ...
4
votes
0answers
65 views

How to select corresponding ciphertext in anonymous Identity-based broadcast encryption

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. It does not describe which user corresponds to which ciphertext part. User ...
3
votes
1answer
71 views

Why is the simulation required in these identity-based encryption security proofs?

In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses ...
3
votes
1answer
105 views

Question on Waters IBE

I'm reading “Efficient Identity-Based Encryption Without Random Oracles” by Brent Waters. In Page 9, I don't know how $$\mathcal{P}_{BDH}=\Pr[\beta'=1]=\Pr[\beta'=1|\textbf{abort}]\Pr[\textbf{abort}]+...
3
votes
1answer
36 views

How to distribute system parameters in identity-based encryption

Identity-based encryption papers describe that system parameters are declared as public. However,in real scenario, how to distribute system parameters to users?
3
votes
1answer
42 views

Concept of “guessed ID” in Authenticated Identity-Based Encryption

In Authenticated Identity-Based Encryption by Ben Lynn, in Proof of Integrity (section 4.3) and Proof of Security (section 4.4), I cannot grab the concept of "guessed ID" . Because encryption differs ...
3
votes
1answer
50 views

Identity-based proxy re-encryption using different system parameters

I am wondering if there is an identity based proxy re-encryption scheme (such as the Green-Ateniese scheme https://eprint.iacr.org/2006/473.pdf) that converts an encryption computed with ID1, system ...
2
votes
2answers
294 views

What is “msg = group.random(GT)” in Charm encryption schemes?

In many encryption schemes in Charm the random group message is used instead of a text-message: msg = group.random(GT) For example, in CP-ABE scheme, random ...
2
votes
1answer
690 views

what's the advantages of identity-based systems over certificate-based ones?

Actually, I'm not familiar to how identity-based and certificate-based systems work, so ,can anyone give me a detail and comprehensive answer to this question? Moreover, in what environments the ...
2
votes
1answer
266 views

Pairings in Identity-based encryption vs. Attribute-based encryption

The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and $e:...
2
votes
2answers
61 views

Security (CPA?,CCA?) in Authenticated identity-based encryption

When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where: $$a=e(d_{A},B)$$ $$s=H_{3}(Msg,K)$$ $$C=<s,\gamma \oplus H_{2}(a,s),H_{4(...
2
votes
1answer
450 views

what is the difference between IBE and ABE schemes

Can somebody explain in simple words. real life example light help and limitations of these schemes etc.
2
votes
1answer
190 views

a possibly stronger type of attack on identity-based encryption

What is known about the security of identity-based encryption schemes against attacks that involve seeing multiple ciphertexts and then receiving the private keys corresponding to some of those ...
2
votes
1answer
88 views

Decryption of message in IBE without random oracle using bilinear pairing registration?

I find the following IBE scheme from the videos posted and i don't understand the decryption algorithm, will any one please elaborate the 6th step scheme Setup($\lambda$) : $(\mathbb{G}, \...
2
votes
1answer
140 views

Question about dual system encryption

Recently, I have been reading some dual system encryption papers. In these systems, is the adversary able to generate “semi-functional ciphertexts”?
2
votes
0answers
30 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
2answers
170 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
2
votes
0answers
62 views

User revocation in Identity Based Encryption

I read several papers about user revocation in IBE recently. A common point is that when a user is revoked, some other valid users should also update their private keys. Does this mean that one ...
2
votes
0answers
354 views

How does identification currently work with the German identity card? [closed]

Since 18th of December 2010 Germany makes use of an identity card that should allow electronic authentication: (image source: commons.wikipedia.org) From a users perspective, the authentication ...
1
vote
2answers
89 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
1
vote
1answer
61 views

Why Boneh-Franklin BasicIdent IBE is not chosen-ciphertext secure? Why use random oracle?

I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security ...
1
vote
1answer
128 views

Identity-Based Encryption consist of four algorithms. Extract phase is one of them and it is done by PKG or receiver?

The Identity-Based Encryption consist of four randomized algorithms: Setup, Extract, Encrypt, Decryption. The Setup phase is done by Private-key generator, Encrypt by sender and Decryption by receiver....
1
vote
2answers
541 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
1
vote
1answer
30 views

Which one is correct probability formula for the same master secret value in identity-based encryption

Assume two servers $(n=2)$ use the same domain curve parameters and same hash function $H:\{0,1\}^{*} \rightarrow G_{1}$ . Then the hash value for the same identity falls in same result and let it be ...
1
vote
1answer
39 views

Do any Identity-based Encryption Systems support messaging between domains?

Identity Based Encryption is covered under RFC 5091 (specifying the algorithm), 5408 (specifying data structures), and 5409 (using IBE with Cryptographic Message Syntax). However, every IBE ...
1
vote
1answer
101 views

Cocks IBE Scheme: why is -a a quadratic residue mod n?

In the Cocks IBE scheme it is required for the hash function, that the Jacobi symbol of its output and the universally available moduls $n = p*q$ is $+1$, so: $\Big(\frac{H(ID)}{n}\Big) = \Big(\frac{...
1
vote
1answer
61 views

Use of the master key in Delerablée's Identity-based Broadcast Encryption

I'm reading “Identity-Based Broadcast Encryption with Constant Size Ciphertexts and Private Keys” by Cécile Delerablée. On page 207, the encryption process needs $\gamma$ which is part of the master ...
1
vote
1answer
264 views

Is it feasible to use combination of ABE schemes for encrypting the data?

I have a peculiar requirement for preserving the shared log files. For example I have 1000 records which belong to different organizations as listed below and all the logs are present in a single CSV ...
1
vote
2answers
123 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper (archive link). The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod n)...
1
vote
0answers
25 views

Some Question about Security Proof of authenticated identity-based encryption

In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding. In key extraction queries,if attacker request for guessed ID, then B fails....
1
vote
0answers
65 views

Why security proof uses random oracles in identity-based encryption?

In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the ...
1
vote
0answers
25 views

Anonymous Identity-based broadcast encryption use single common key or different keys

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ ...
1
vote
0answers
131 views

Example describing Baek and Zheng’s threshold identity-based decryption scheme

I am trying to work through an example of Baek and Zheng’s “threshold identity-based decryption scheme” and I tried a lot to solve this, but somewhere I’m doing something wrong. I hope someone can ...
1
vote
0answers
44 views

Is Attribute based encryption sub-class of Identity based encryption [duplicate]

I have a basic question related to Identity and Attribute based encryption. Construction of IBE scheme was first shown by Boneh et al. in 2001 and I think in 2004 Sahai and Waters introduced ...
1
vote
0answers
115 views

How to compare different signature scheme's performance?

I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair ...
1
vote
0answers
119 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
0
votes
1answer
41 views

Hash Function representation in identity-based encryption

Some describe as $H:F_{q}\times G_{2}\rightarrow \{0,1\}^{n}$.Some describe as $H:\{0,1\}^{*}\times\{0,1\}^{*}\rightarrow F_{q}$. What is the meaning of product function? what kind of operation does ...
0
votes
1answer
36 views

Subscript R notation for the finite fields

I'm trying to understand the notation used in the literature for Pairing-based cryptography. I know (and I hope I've understood it well) from Wikipedia that $\mathbb{Z}_p$ is the finite field of ...
0
votes
1answer
68 views

Possibility for same Private Key Generation in identity-based encryption

In private key generation of IBE scheme, private key is generated as follows: $SK_{ID}=s.H(ID)$ Suppose two servers use the same curve domain parameters. If PKG on server A generates private key $SK_{...
0
votes
1answer
29 views

What are the benefits of being able to choose (most of) the public key in a PKC?

We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue). However, we have a ...
0
votes
1answer
25 views

How to run a (provably probably) secure global referendum?

The following question is extremely broad and speculative, for which I apologize, but it strikes me as exceedingly important, so I will ask it nonetheless. Suppose an event of global significance ...
0
votes
1answer
35 views

Probability of generating same master secret key in Identity-based Encryption

Suppose multiple servers use same IBE domain parameters (I mean same curve description parameters and field) for master secret key setup. Is there any possibility for generating the same system ...
0
votes
1answer
35 views

Advantage of attacker in CPA secure IBE

In CPA secure IBE systems, the advantage of attacker (A) is defined as absolute value of $$Pr[b=b^{'}]-\frac{1}{2}$$ Can someone please explain this to me in a few words? Where exactly does that ...
0
votes
0answers
23 views

Proof of Integrity in authenticated identity-based encryption

In authenticated ID-based encryption by Benn Lynn, in proof of integrity in section 4.3,Meaning of guess-ID? Why is it assumed that $L_{s}$ is empty, then $B$ fails? If guessed ID, why encryption ...
0
votes
0answers
32 views

Decryption Queries and its meaning in identity-based encryption

In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need ...