4
$\begingroup$

Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $\mathbb{QR}_N$ in $\mathbb{Z}/N\mathbb{Z}$ to reduce the ciphertext expansion by half?

I think it is also IND-ID-CPA secure in random oracle because we can learn nothing from the ciphertext when the hash function H of some ID is chosen from $\mathbb{J}_N/\mathbb{QR}_N$.

$\endgroup$
  • 1
    $\begingroup$ It’s unclear how to implement such a hash function, in part because quadratic residues are conjecturally hard to recognize (and such hardness is needed for the security of Cocks’s scheme anyway). Note also that it’s insecure to hash to an “intermediate” value and then square it to obtain the final hash value. $\endgroup$ – Chris Peikert Mar 25 at 23:34
  • $\begingroup$ Thank you very much for your reply. In the last sentence, can you elaborate on the reasons for insecurity? If the hash function is treated as a random oracle (a random mapping of arbitrary space to arbitrary space), can it theoretically prove the IND-ID-CPA security in random oracle with quadratic residues assumption? $\endgroup$ – Xiaopeng Zhao Mar 25 at 23:55
  • $\begingroup$ It’s simple: if the “final” hash value is the square of the “intermediate” hash value, then the intermediate value is a secret key for the final value (which plays the role of the public key). The adversary can also compute the intermediate value, so it can decrypt any ciphertext encrypted to the final value. $\endgroup$ – Chris Peikert Mar 25 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.