OK, I am confused. Does it mean that that the various anonymous multi-receiver IBE implementations actually do not have single public key per Identity, as as is the in the original IBE implementation?

Example paper: Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security (PDF) by Fan et al.


1 Answer 1


As always there is only one system public key (also called "public parameters" or simply "parameters"). In IBE, the identifiers of users are publicly known which can be used in conjunction with the public key to compute temporary group elements.

If you look into the scheme you're linked to, you should see that there is only one set of "params" which represent the public key with all of its configurations.

Of course, the user identifier must be kept authentic in the same way that RSA public keys of all of the recipient users must be kept authentic. If an attacker makes you believe to encrypt some data to their own identifier, then you have lost, but that doesn't have anything to do with a scheme and more of an issue with fully designed systems.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.