I don't know why BasicIdent is not chosen-ciphertext secure. If there are anybody who knows well, please explain it to me with example. Moreover, I don't know random oracle and its usage for security analysis.


1 Answer 1


First, recall that in a chosen-ciphertext attack (CCA) model, the attacker has access to a decryption oracle. A scheme is said CCA-secure if access to a decryption oracle does not give any advantage to the attacker.

Knowing this, a very simple CCA attack can be done on BasicIdent. I will use the description of the scheme from Wikipedia.

As you can see, ciphertexts in BasicIdent are tuples of the form $$c = (u,v) = \left(rP, m \oplus H_2\left(g_{ID}^r\right)\right)$$

The important thing here is that the second term of the ciphertext is simply the message XOR'ed with a hash. So, in the IND security game, the attacker can take the challenge ciphertext $c^* = (u^*, v^*)$ and produce a new ciphertext $\hat c = (u^*, v^* \oplus \hat m)$, for some random message $\hat m$. This new ciphertext must be accepted by the decryption oracle since $c^* \neq \hat c$. The result from the decryption oracle is $m_b \oplus \hat m$, and the attacker can trivially extract the original message $m_b$ from this since he knows $\hat m$.

  • $\begingroup$ Clear explanation. $\endgroup$ Commented Jan 27, 2016 at 10:23
  • $\begingroup$ cygnusv. I have another question. In IBE, server generates private keys for users. h pow (r+H(IDc)). where s is the secret key of server, IDc is the identity of clients. $\endgroup$ Commented Jan 27, 2016 at 10:29
  • $\begingroup$ cygnusv. In IBE, server generates private keys for users, for example Kc= h pow (r*H(IDc)), Pc=g, where Pc is the public key of server, r is the secret key of server, IDc is the identity of clients and Kc will be private key for client.Instead of sending these private keys to users in advance, can the server give (T=rh) in sending encrypted message C1=e(g,h) xor msg to users. At that time the user make T1=H(ID)*rh by multiplying H(ID) to T. Then by combining e(g,T1) xor C1. In this case, will there security if the H(ID) is not known by others because rh is known by all users. $\endgroup$ Commented Jan 27, 2016 at 10:36
  • 1
    $\begingroup$ @J.Sames Welcome to Crypto.SE. Since you are a new user, maybe you are not familiar with the way this site works. In particular, it is discouraged to put new questions in the comments to the answers. Comments are reserved for clarifications on the answer. If you have more questions, you should put a new question on the site. Apart from that, you can upvote or downvote answers, depending if you find them useful or not. This is the way of expressing the usefulness of an answer, not through a comment. $\endgroup$
    – cygnusv
    Commented Jan 27, 2016 at 11:17
  • $\begingroup$ Any encrypt-then-MAC scheme trivially prevents this attack, but many authors do so using problematic schemes like Fujisaki-Okamoto transformations, so this answer seems not particularly thorough $\endgroup$ Commented Mar 10, 2018 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.