Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $$\mathbb{QR}_N$$ in $$\mathbb{Z}/N\mathbb{Z}$$ to reduce the ciphertext expansion by half?
I think it is also IND-ID-CPA secure in random oracle because we can learn nothing from the ciphertext when the hash function H of some ID is chosen from $$\mathbb{J}_N/\mathbb{QR}_N$$.