# Security (CPA?,CCA?) in Authenticated identity-based encryption

When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where:

$$a=e(d_{A},B)$$ $$s=H_{3}(Msg,K)$$ $$C=<s,\gamma \oplus H_{2}(a,s),H_{4(\gamma)}(Msg)>$$

Revealing [$H_{2}(a,s)$] can break the security if the correct ($a$) value is known by attacker.

The scheme may be CPA-secure if the private key extraction query restricts for sender's identity. However, if decryption oracle exists, will it be CCA-secure?

Attacker will modify the ciphertext as follows:

$$C^{*}=<s,\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s),H_{4(\gamma)}(Msg)>$$

where $t$ will be any pairing operation and submits $(C^{*},IDB)$ to decryption oracle. I think the oracle will return $\gamma \oplus H_{2}(t,s)$. Thus, attacker can easily reveal $\gamma$ by XORing with $H_{2}(t,s)$.

Could you tell me if it is CCA-secure?

What is a suitable assumption for the problem of finding $e(d_{A},ID_{B})$ value knowing $ID_{A}$ and $ID_{B}$? Is it a bilinear Diffie-Hellman problem?

• I've made some formatting related and textual changes (check the edits!). Could you check if the content of the question is still OK? – Maarten Bodewes Jun 13 '16 at 19:20

The eprint version has the following to say (adapted for your notation):

Authenticated-decrypt: [...]
Check that $s = H_3(\gamma, Msg)$. If not, reject the ciphertext, otherwise output then plaintext $Msg$.

In the attackers case, the decryption oracle would try to check if $s = H_3(\gamma', Msg)$ with $\gamma'=\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s) \oplus H_2(a, s) = \gamma \oplus H_{2}(t,s)$. This leads to a wrong hash and the oracle rejects the decryption before giving any useful information to the attacker.

• Artjom B. Can you please explain suitable assumption for finding value of $e(d_{A},ID_{B})$ , given $ID_{A},ID_{B}$?? – La Yate May Jun 14 '16 at 6:58
• Artjom B. In the above problem, if $t=a$ then, the attacker achieves in decryption oracle. As $s$ value is given, the problem lies in finding $a$ value. Can you please explain suitable assumption for finding value of $e(d_{A},ID_{B})$ , given $ID_{A},ID_{B}$?? – La Yate May Jun 14 '16 at 7:04
• No, I can't give you a suitable assumption. We can say that $a=e(d_A, H_2(IDB))=e(H_2(IDA)^r, H_2(IDB))$ (where $r$ is the MSK). Since $H_2(IDX)$ can be written as $g^{r_x}$ for some unknown $r_x$, this can be contrived to resemble the BDH assumption: given $g, g^{r_A}, g^{r_B}, g^r$, compute $e(g, g)^{r_Ar_Br}$, but none of the "givens" are actually given. – Artjom B. Jun 14 '16 at 9:15
• If $t=a$, then the second ciphertext component would collapse to $\gamma$ and the decryption oracle would still reject the ciphertext. – Artjom B. Jun 14 '16 at 9:16
• I also don't know whether this is CCA-secure, but I'm assuming it is. – Artjom B. Jun 14 '16 at 9:17

You can assume CDH assumption. Suppose A's public and private key $g^x$ and $x$. In the same way, B's public and private key $g^y$, $y$. Then shared secret key $g^xy$ will have same concept with $a=e(d_{A},B)$. IF CDH is hard, then no one but A and B can compute $a$