In Gentry's paper 'Practical Identity-Based Encryption without Random Oracles', I have a little difficulties in understanding the security proof part. The paper claims that in Challenge phase, 'ID must not have appeared in any key generation query in Phase 1', while in Phase 2, 'the adversary may not request a private key for ID or the decryption of (ID, C)'. But in the security proof part, these 2 restrictions seem to be omitted. Can anyone explain why?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.