Let's consider a situation whereby:

Alice generates a ciphertext c from a message m using Bob’s ID.

An attacker Carol can get c from the open channel. She knows that c is generated by using Bob’s ID but she does not know Bob’s secret key.

On the other side, Carol is able to know the random number r that Alice has used in the encryption process

Also, it is given that the identity-based decryption formula is as such:

Encrpytion: $c = (u,v) = (\mathtt{g}^{r}, m \oplus {H({T}_{id}^r)})$

Decryption: $m = v \oplus H(e(\mathtt{d}_{id}, u))$

This is also the standard IBE Bilinear Pairing.

I also managed to deduce this equation below from deriving the decryption algorithm.

$m = v \oplus H(\mathtt{{\mathtt{T}_{id}}}^{r})$

Now consider this question:

Can Carol compute the plaintext message $m$ by just knowing $r$ but not Bob’s secret key?

My answer: It's not possible for Carol to compute $m$ just by knowing $r$ because she still has to solve the discrete log problem in the last equation given which is considered hard.

However, I am unsure whether this is right or wrong.


Formula for ${T}_{id}= e({Q}_{id},{K})$, where K is the master public key (${g}^{s}$), and ${Q}_{id}$ is the hash of the user id

Formula for ${d}_{id} = ({Q}_{id})^s$, where s is the master secret key

  • $\begingroup$ What is the formula for $T_{id}$ and $d_{id}$? $\endgroup$
    – Mahdi
    Nov 11, 2019 at 8:46
  • $\begingroup$ @MahdiSedaghat edited into the post. please check it. also this is a really good reference on the algorithm: link $\endgroup$ Nov 11, 2019 at 8:54

1 Answer 1


Thanks. I guess $K=g^s$. It seems trivial if Carol knows the random integer $r$ then she can learn the message. As you mentioned everybody could compute $T_{id}$ because both $Q_{id}$ and $K$ are public amongst the network. Since Carol knows $r$ then she can compute $Z=T_{id}^r$ and hash of this result! To learn the message, she has to calculate,

$$m=v \oplus H(Z)=m \oplus H(T_{id}^r) \oplus H(T_{id}^r)=m \oplus (H(T_{id}^r)\oplus H(T_{id}^r))=m \oplus 0=m$$

In general, Carol does not need to know the master secret key $s$ to read the message. The Encryption phase is randomized by the integer $r$ and for a Chosen Ciphertext Carol can learn the message. While we know she can not compromise the forward and backward secrecy of the scheme because the Discrete Logarithm is hard and the random integer for next ciphertext will be sampled, independently.

  • $\begingroup$ I'm still confused. So essentially it's still possible to find m because she can solve $\mathtt{H(Z)}$? How about v though, does it not have an effect in this? Also, it's not possible to break the secrecy of other ciphertexts due to the fact that r is picked randomly for each encryption? $\endgroup$ Nov 11, 2019 at 9:40
  • $\begingroup$ Yes, exactly. She can find $m$ because she knows $r$. You are right for the next sentence since $r$ for the next ciphertext would sample uniformly then the rest of plaintext will remain secure. $\endgroup$
    – Mahdi
    Nov 11, 2019 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.