# Tag Info

6

PE is a subclass of FE. This (from the other answer) is correct. Also, from my understanding, your analogy is correct. PE returns the plaintext if the predicate evaluates to true. FE, on the other hand, returns a function of the plaintext. We can say that PE is a subclass of FE, since we can use FE to implement PE. Just use the identity function. ...

5

Public key crypto vs. identity-based crypto made short: In traditional public key cryptography, a user $A$ generates a private/public key pair $(sk_A,pk_A)$ and since this key pair has absolutely no indication to which indentity (user $A$) it belongs, it is necessary to certify the public key, i.e., bind the public key $pk_A$ to the user $A$'s identity. ...

4

There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write it additively $e(aP,bQ)=e(P,Q)^{ab}$. This comes from the fact that in $e : \mathbb{G}_1\times \mathbb{G}_2\to\mathbb{G}_T$, $\mathbb{G}_1$ and $\mathbb{G}_2$ ...

4

In real world applications Attribute-based Encryption (ABE) is used in conjunction with a symmetric cipher, because you can only encrypt group elements with ABE. In this case it is the multiplicative group $G_T$. The number of bits is limited when you try to represent text messages (bit strings) with a group element, because the size of the group is derived ...

4

Zero-knowledge proofs of knowledge basically allow Alice to convince someone beyond a reasonable doubt that she knows a certain piece of information (i.e., the answer to a certain question), without revealing what exactly that information is. One simple example involves the discrete logarithm problem, which you might be familiar with: given a (large) prime ...

4

She can generate a key-pair and include the public key in the book. Having the private counterpart she can at any time proove that she wrote the book by signing an arbitrary statament.

3

It is very hard to give a concrete, "apples-to-apples" comparison of lattice-based and pairing-based IBE schemes. There are many reasons: the research surrounding concrete secure parameters for LWE is still evolving, efficient implementations of operations used in lattice-based IBE (e.g., discrete Gaussian sampling) are still works in progress, one can ...

3

First, recall that in a chosen-ciphertext attack (CCA) model, the attacker has access to a decryption oracle. A scheme is said CCA-secure if access to a decryption oracle does not give any advantage to the attacker. Knowing this, a very simple CCA attack can be done on BasicIdent. I will use the description of the scheme from Wikipedia. As you can see, ...

3

The problem can be simplified to the following problem, since the standard argument doesn't really take into account that you can't generate all the polynomials of the given maximum degree : Assume that we have sampled a random point $\vec{x}\in \mathbb{F}_p^n$. We let an adversary adaptively choose polynomials of degree at most $d$ and after each choice ...

3

The BSW07 CP-ABE scheme is a pairing based construction. Denoting the pairing as $e:G\times G\rightarrow G_T$ (symmetric notation for simplicity), the message space of this scheme is the prime order $q$ group $G_T$, which in practice is a prime order $q$ subgroup of the multiplicative group of some finite field. Consequently, if you have a message $m$ and ...

3

The problem that arises in the security proof is that the adversary who may win the real game with some probability may however cause the simulation to nearly always abort (by issuing a private key query that requires the simulation to abort) and the probability of an abort may be different for different sets of private key queries. So, the problem is that ...

3

With IBE the public key is a public bitstring as your email. A Key-authority issues a secret key that is tied with this public key.The owner of the secret key can only decrypt. ABE entails more complex access control on decryption operation such as:"Only the owner of the secret key that corresponds to: Area:=Italy AND Age:<30 and Business:=Researcher" ...

3

PE is a subclass of FE. A description can be found on page 256 of the book “Theory of Cryptography: 8th Theory of Cryptography Conference, TCC 2011”. The related paper is available in PDF format via eprint.iacr.org: Functional Encryption: Definitions and Challenges Dan Boneh, Amit Sahai, Brent Waters

3

First of all, let us simplify the equation by replacing things that the attacker can compute with known constants. We come up with: $$a \cdot b^x = y$$ where the attacker knows $a$ (which is $e(g,h)^k$) and $b$ (which is $e(g, h)$, which he can compute, as he knows $g, h$), and the attacker solves for $x, y$. If it is sufficient for an attacker to find a ...

3

To quote yyyyyyy from the comments: The $_R$ has nothing to do with the field — it is associated to $\in$! To quote your first link: "For a set $S$, by $a\in_R S$, we mean that $a$ is randomly chosen from $S$." and to quote SEJPM from the comments: If $p\in \mathbb P$ (with $\mathbb P$ being the set of all primes) then the notations ...

2

You can probably prove the security against your game from the security in the IND-ID-CCA game of Boneh and Franklin (see http://courses.cs.vt.edu/cs6204/Privacy-Security/Papers/Crypto/IBE-Weil-Pairing.pdf). The idea is to create an adversary $\mathcal{B}$ against IND-ID-CCA from your adversary $\mathcal{A}$. Essentially $\mathcal{B}$ will play ...

2

What you are describing is an anonymous credential system. There are two different ways to go about making these and two actual systems that use those techniques: Microsoft's U-prove and IBM's Idemix. If you're interested in smart card usage, you'd probably prefer U-prove as it tends to work better with smart cards. It's described by its original ...

2

If Bob and Charlie will share a secret, then it information-theoretic privacy might be possible, otherwise the best that can be hoped for is computational anonymity. I haven't come up up with any way to achieve information-theoretic privacy when Bob and Charlie share a secret, so I will only be addressing computational privacy. I assume that Bob can ...

2

It's been a while since I've read this paper, and I remember having a lot of trouble with this derivation. I'm sure there is an easy way to see it, but I don't see it, so I'll just brute force through with the algabra. First, some context: When the simulator is given a random element as the last term in the tuple the simulator will either abort (and ...

2

Alice generates a signature key-pair and puts $\;$ the fact that she's using this identity-proving construction $\;\;\;\;$ and $\;$ the digital signature scheme $\;\;\;\;$ and $\;$ the prefix-free code $\;\;\;\;$ and $\;$ the verification key into the book, and keeps the signing key. (Let "||" denote concatenation.) For interactive verification, the ...

2

The Extract phase is performed by the Private Key Generator (PKG). Note that in IBE it is not necessary a Public Key Generator, since public keys are just arbitrary bit strings or "identities". So, to sum up: Setup, executed by the PKG. This algorithm creates, among other things, a master key for the PKG. Extract, executed by the PKG. This algorithm ...

2

Compute $d$ such that $ed\equiv 1\bmod{\varphi(n)}$ using extended euclidean algorithm. Then compute $g = i^d\bmod{n}$. This is basically RSA decryption.

2

I am really not sure about what you are trying to do. If you simply want to prove that $Ans = e(g,h)^k \times e(g,h)^r$ is hidden given only $(g,h,e(g,h)^k)$, then this is trivial and does not require any hypothesis at all (in particular, no discrete logarithm problem is involved). Indeed, this is perfectly equivalent to the problem of finding $e(g,h)^r$ ...

2

I assume $s$ and $b$ are the main master secret key components of two IBE servers. If $s=b$, then $SK_{ID,s}=SK_{ID,b}$ provided that the curve parameters and the hash function $H$ are the same. Now, the question is what's the probability of two IBE servers generating the same master secret key components. This depends on the actual scheme and the field it ...

1

Yes, it is possible, but extremely improbable. Take for example the BasicIdent IBE scheme, by Boneh and Franklin. Let us assume that the curve, pairing and groups are fixed. During the Setup step, one has to select a random generator $P \in \mathbb G_1$ and a random master key $s \in \mathbb Z_q^*$. We can assume that these parameters are sampled ...

1

This concept is called inter-domain identity-based proxy re-encryption. In this case, the notion of "domain" implies a separate KGC and a set of system parameters. There are a couple of schemes doing this: Tang, Q., Hartel, P., & Jonker, W. (2008, December). Inter-domain identity-based proxy re-encryption. In Information Security and Cryptology (pp. ...

1

I've now spoken with representatives from two IBE vendors. The Voltage system allows "federation" by which one Voltage appliance can exchange system parameters with another Voltage appliance. It's not clear if this is done using RFC 5091, RFC 5408 and RFC 5409. The other vendor does not support such a mode of operation.

1

No. The key factor is the security level - a scheme has n bits of security if it takes roughly $2^n$ work ($\approx$ time x space) to break. So one can compare for example Diffie-Hellman key exchange in finite fields and over elliptic curves at the 128 bit security level and conclude that EC are more efficient (that is why they were invented, after all). ...

1

I don't know whether it is correct $$e(c_1,d_1) = e(g^s, mk\cdot(y^{id\cdot h})^r)$$ $$=e(g^s,mk)\cdot e(g^s, (y^{id\cdot h})^r)$$ $$= e(g^s , g_1^\alpha ) \cdot e(g^r , (y^{id\cdot h})^s)$$ $$= e(y , g_1^\alpha ) \cdot e(g^r , (y^{id\cdot h})^s)$$ $$e(c_2,d_2) = e((Y^{id\cdot h})^s , g^r)$$ $$= e((Y^{id\cdot h})^s , g^r)$$ therefore ...

1

If $a$ is a nonresidue mod $p$, then since $-1$ is also a nonresidue mod $p$ by construction, $-a$ is a residue mod $p$. And likewise mod $q$, so $-a$ is a residue mod $pq$.

Only top voted, non community-wiki answers of a minimum length are eligible