2
$\begingroup$

When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where:

$$a=e(d_{A},B)$$ $$s=H_{3}(Msg,K)$$ $$C=<s,\gamma \oplus H_{2}(a,s),H_{4(\gamma)}(Msg)>$$

Revealing [$H_{2}(a,s)$] can break the security if the correct ($a$) value is known by attacker.

The scheme may be CPA-secure if the private key extraction query restricts for sender's identity. However, if decryption oracle exists, will it be CCA-secure?

Attacker will modify the ciphertext as follows:

$$C^{*}=<s,\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s),H_{4(\gamma)}(Msg)>$$

where $t$ will be any pairing operation and submits $(C^{*},IDB)$ to decryption oracle. I think the oracle will return $\gamma \oplus H_{2}(t,s)$. Thus, attacker can easily reveal $\gamma$ by XORing with $ H_{2}(t,s)$.

Could you tell me if it is CCA-secure?


What is a suitable assumption for the problem of finding $e(d_{A},ID_{B})$ value knowing $ID_{A}$ and $ID_{B}$? Is it a bilinear Diffie-Hellman problem?

$\endgroup$
  • $\begingroup$ I've made some formatting related and textual changes (check the edits!). Could you check if the content of the question is still OK? $\endgroup$ – Maarten Bodewes Jun 13 '16 at 19:20
2
$\begingroup$

The eprint version has the following to say (adapted for your notation):

Authenticated-decrypt: [...]
Check that $s = H_3(\gamma, Msg)$. If not, reject the ciphertext, otherwise output then plaintext $Msg$.

In the attackers case, the decryption oracle would try to check if $s = H_3(\gamma', Msg)$ with $\gamma'=\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s) \oplus H_2(a, s) = \gamma \oplus H_{2}(t,s)$. This leads to a wrong hash and the oracle rejects the decryption before giving any useful information to the attacker.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Artjom B. Can you please explain suitable assumption for finding value of $e(d_{A},ID_{B})$ , given $ID_{A},ID_{B}$?? $\endgroup$ – La Yate May Jun 14 '16 at 6:58
  • $\begingroup$ Artjom B. In the above problem, if $t=a$ then, the attacker achieves in decryption oracle. As $s$ value is given, the problem lies in finding $a$ value. Can you please explain suitable assumption for finding value of $e(d_{A},ID_{B})$ , given $ID_{A},ID_{B}$?? $\endgroup$ – La Yate May Jun 14 '16 at 7:04
  • $\begingroup$ No, I can't give you a suitable assumption. We can say that $a=e(d_A, H_2(IDB))=e(H_2(IDA)^r, H_2(IDB))$ (where $r$ is the MSK). Since $H_2(IDX)$ can be written as $g^{r_x}$ for some unknown $r_x$, this can be contrived to resemble the BDH assumption: given $g, g^{r_A}, g^{r_B}, g^r$, compute $e(g, g)^{r_Ar_Br}$, but none of the "givens" are actually given. $\endgroup$ – Artjom B. Jun 14 '16 at 9:15
  • $\begingroup$ If $t=a$, then the second ciphertext component would collapse to $\gamma$ and the decryption oracle would still reject the ciphertext. $\endgroup$ – Artjom B. Jun 14 '16 at 9:16
  • $\begingroup$ I also don't know whether this is CCA-secure, but I'm assuming it is. $\endgroup$ – Artjom B. Jun 14 '16 at 9:17
1
$\begingroup$

You can assume CDH assumption. Suppose A's public and private key $g^x$ and $x$. In the same way, B's public and private key $g^y$, $y$. Then shared secret key $g^xy$ will have same concept with $a=e(d_{A},B)$. IF CDH is hard, then no one but A and B can compute $a$

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.