Are there any existing open source implementations of “id-tied” public/private key encryption?

Question

I don't quite know how to even ask the question for what I have in mind; but succinctly, I'm looking for some publicly implemented cryptosystem where messages for a user with id U can be sent to U using nothing but a single system-wide public key and knowledge of U.

I have an unusual situation where I've been asked to code support for a massive peer-to-peer computing project with no central server. There is a central trusted authority that can email people secrets, very slowly, but isn't available at scale or in realtime to resolve issues of identity and authorization during a time when they will all be heavily active talking to each other.

Each entity in the system has a unique identifier U, which we can imagine as a positive integer. As an abuse of notation, I'll use U to both refer to the entity, and their id.

Rather than try to publish and/or promulgate a very large number of authority-issued certificates tying U to its own public key, which I think is the normal way of doing this, I'm hoping to use a cryptographic communication scheme such that given a shared (ie, known to all entities) public key E, any party can send a private message M to U via some f[U, E](M).

For instance, based on my limited understanding of RSA, the idea is for some master to generate N = p*q, for p and q prime, and then calculate some E and D, E*D == 1 mod phi(N). Then E may serve as a public key, and D as a private key, via (M**E)**D mod N. If instead we use E*D*U == 1 mod phi(N), then D*U may be used to encrypt M, and E can be U's private key. As a bonus, this remains symmetric; U can sign something using D, and anyone else can verify using U*E.

The idea is then that the central authority could pick N, not reveal p or q, promulgate N and E publicly, and email each entity U its private secret D value, by which they would later identify themselves. From that point forward, any doubter could authenticate an entity claiming to be U, by sending challenges encrypted as E*U, and confirming the entity claiming to be U can decrypt. (I do not worry about private keys having been compromised.)

So good in theory, but all I've ever heard is that you don't want to ever implement your own crypto library. Is there anything like the above that already pre-exists as an open-source and battle-tested solution?

Answer 1

What you're looking for is probably Identity-Based Encryption (IBE).

I'm not sure if I've got the terminology correct, but here's a few concept with IBE.

IBE has a key generation center that has a function equivalent to a CA. The key generation center manages a master private key for deriving private keys for decryption users, and a master public key for which encryption users to derive the public keys corresponding to the decryption users.

The rest is pretty much the same with other public-key encryption: encryption users encrypt their messages with the public key of the decryption users and send the ciphertext to them; the decryption users decrypt the message with the private key they've obtained from the key generation center.

It is to be noted that there is the obvious problem of key escrow and difficulty with revoking exposed private keys.

China has developed the SM9 identity-based cryptography standard. An English version is available at IACR. The official version is in Chinese, and is behind paywall, some provincial administration publish free links to Baidu Netdisk file sharing service.

The OpenSSL fork GmSSL mentioned in the comment, has appears to be the most comprehensive implementations of Chinese commercial cryptography standards.