When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where:

$$a=e(d_{A},B)$$ $$s=H_{3}(Msg,K)$$ $$C=<s,\gamma \oplus H_{2}(a,s),H_{4(\gamma)}(Msg)>$$

Revealing [$H_{2}(a,s)$] can break the security if the correct ($a$) value is known by attacker.

The scheme may be CPA-secure if the private key extraction query restricts for sender's identity. However, if decryption oracle exists, will it be CCA-secure?

Attacker will modify the ciphertext as follows:

$$C^{*}=<s,\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s),H_{4(\gamma)}(Msg)>$$

where $t$ will be any pairing operation and submits $(C^{*},IDB)$ to decryption oracle. I think the oracle will return $\gamma \oplus H_{2}(t,s)$. Thus, attacker can easily reveal $\gamma$ by XORing with $ H_{2}(t,s)$.

Could you tell me if it is CCA-secure?

What is a suitable assumption for the problem of finding $e(d_{A},ID_{B})$ value knowing $ID_{A}$ and $ID_{B}$? Is it a bilinear Diffie-Hellman problem?

  • $\begingroup$ I've made some formatting related and textual changes (check the edits!). Could you check if the content of the question is still OK? $\endgroup$
    – Maarten Bodewes
    Commented Jun 13, 2016 at 19:20

2 Answers 2


The eprint version has the following to say (adapted for your notation):

Authenticated-decrypt: [...]
Check that $s = H_3(\gamma, Msg)$. If not, reject the ciphertext, otherwise output then plaintext $Msg$.

In the attackers case, the decryption oracle would try to check if $s = H_3(\gamma', Msg)$ with $\gamma'=\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s) \oplus H_2(a, s) = \gamma \oplus H_{2}(t,s)$. This leads to a wrong hash and the oracle rejects the decryption before giving any useful information to the attacker.

  • $\begingroup$ Artjom B. Can you please explain suitable assumption for finding value of $e(d_{A},ID_{B})$ , given $ID_{A},ID_{B}$?? $\endgroup$ Commented Jun 14, 2016 at 6:58
  • $\begingroup$ Artjom B. In the above problem, if $t=a$ then, the attacker achieves in decryption oracle. As $s$ value is given, the problem lies in finding $a$ value. Can you please explain suitable assumption for finding value of $e(d_{A},ID_{B})$ , given $ID_{A},ID_{B}$?? $\endgroup$ Commented Jun 14, 2016 at 7:04
  • $\begingroup$ No, I can't give you a suitable assumption. We can say that $a=e(d_A, H_2(IDB))=e(H_2(IDA)^r, H_2(IDB))$ (where $r$ is the MSK). Since $H_2(IDX)$ can be written as $g^{r_x}$ for some unknown $r_x$, this can be contrived to resemble the BDH assumption: given $g, g^{r_A}, g^{r_B}, g^r$, compute $e(g, g)^{r_Ar_Br}$, but none of the "givens" are actually given. $\endgroup$
    – Artjom B.
    Commented Jun 14, 2016 at 9:15
  • $\begingroup$ If $t=a$, then the second ciphertext component would collapse to $\gamma$ and the decryption oracle would still reject the ciphertext. $\endgroup$
    – Artjom B.
    Commented Jun 14, 2016 at 9:16
  • $\begingroup$ I also don't know whether this is CCA-secure, but I'm assuming it is. $\endgroup$
    – Artjom B.
    Commented Jun 14, 2016 at 9:17

You can assume CDH assumption. Suppose A's public and private key $g^x$ and $x$. In the same way, B's public and private key $g^y$, $y$. Then shared secret key $g^xy$ will have same concept with $a=e(d_{A},B)$. IF CDH is hard, then no one but A and B can compute $a$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.