Why use pairing to construct identity based encryption?

Question

Identity Based Encryption is an asymmetric encryption scheme such that encryption uses the receiver's identity as the public key. Such a identity can be receiver's email address or some other string that stands for receiver's identity. In this way, before encryption we need not verify the receiver's public key like traditional public key encryption do. Hence we can get rid of the certificate and save a lot of resources.

In 2001, Boneh and Franklin constructed the first identity-based encryption scheme by using Weil pairing. Before that, pairing was mostly considered as an attack method to ECDLP problem (MOV attack). After this construction, pairing has attracted many attention. And based on pairing, a lot of scheme like attributed encryption, functional encryption have been developed.

Boneh's IBE seems do the construction like this way: for an arbitary ID, use an MapToPoint method to map the ID to a point in a elliptic curve. Then based the point, we compute a mask to xor with a message to complete the encryption.

I can verify the correctness of the encryption scheme, but I can't understand why the authors use the pairing for the construction. In a traditional PKE like RSA, can we just find some wise "map method" also map the ID string to a big number, and then use it for public key? What's the drawback of this method?

Apparent it won't be that easy or else it would not have been an open problem for 20 years. But I need some help to understand how difficult the problem is.

Answer 1

I can't understand why the authors use the pairing for the construction. In a traditional PKE like RSA, can we just find some wise "map method" also map the ID string to a big number, and then use it for public key? What's the drawback of this method?

Well, with IBE, it is necessary that:

• It is hard to, with only the public parameters, to obtain the private key corresponding to a public identity

• It is easy to, with the private parameters which is secret to the IBE server, to obtain the private key.

The first is necessary for security; the second is necessary for the system to be workable.

In your case of 'mapping an ID string to a big number (which we presumably use as an RSA modulus)', we would need a way that maps it to a number we can factor only with the IBE private parameters, and we don't know how to do that.