# RIBE Scheme Implementation - How to encrypt message

This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU

The encryption method specifies part of the encryption process to be $$\hat e(g_1, g_2)^r \cdot M$$ where $$g_1$$ and $$g_2$$ are public parameters in cyclic group $$G_1$$, $$\hat e$$ is the pairing function and $$M$$ is the actual message.

My question is what this $$\cdot$$ operator actually implies for an implementation - is it taking chunks of the $$M$$ equal to the bit length of the result of $$\hat e(g_1, g_2)^r$$ and then adding* them together?

*My understanding, perhaps wrongly, is that the multiply operation for elliptic curve groups is addition based on this

Given that the authors (as any sane person should¹) use multiplicative notation for all of the involved groups, "$$\cdot$$" simply represents the group operation in the target group $$G_2$$.
It does not seem to be explicitly specified as far as I can tell from skimming the paper, but this implies that the message space of the encryption scheme is exactly $$G_2$$, meaning that we always have $$M\in G_2$$. So there are no "chunks" involved.
If you want to encrypt a message directly with the scheme, this means that you will need to encode it as a $$G_2$$ element. If your message is too long for that, you will need to use one of the standard domain extension techniques, such as using the RIBE as a KEM in a hybrid encryption scheme.
• @sumo If you are using the encryption scheme as a KEM, then yes. Choose a uniform element $X\in G_T$ and encrypt it. Then use $KDF(X)$ as a key. – Maeher Apr 16 '19 at 7:08