Questions tagged [identity-based-encryption]

In identity-based encryption (IBE) the public key of a user $A$ is some identity string $ID_A$, e.g., an email address. To encrypt a message for this user there is no need to retrieve an authentic copy of the public key, as it is in public key cryptography, but one can simply use the identity string $ID_A$.

Filter by
Sorted by
Tagged with
1 vote
0 answers
52 views

"Shifting" a dual-Regev keypair away from a trapdoored instance

This question pertains to identity-based key encapsulation mechanisms (IB-KEMs). To recap the functionality: $\mathsf{KeyGen}(1^\lambda) \to (\mathsf{msk}, \mathsf{mpk})$ Generates the master keypair ...
  • 29
1 vote
1 answer
52 views

OTP like Identity

I am a developer with very little experience on the crypto part, and I'm looking for a secure solution (OTP Like) for identifying between client (browser) and server. this is what i need: Web Page at ...
1 vote
1 answer
75 views

Why use pairing to construct identity based encryption?

Identity Based Encryption is an asymmetric encryption scheme such that encryption uses the receiver's identity as the public key. Such a identity can be receiver's email address or some other string ...
  • 51
2 votes
1 answer
110 views

Properties of the bilinear pairing groups?

I stumbled across this correctness of a scheme: $e(g^r, H(id)^x) = e(g^x, H(id))^r = e(g^x, H(id))^r$ and have a hard time following the properties of the bilinear pairing. Does anyone know the "...
  • 75
0 votes
1 answer
23 views

Distributing the Master Public Key in Identity-based Encryption systems

I was just wondering how the private key generator should publish the master public key inside of an IBE system. This key is needed for all devices in the network to derive the public key of receiving ...
1 vote
2 answers
79 views

Proving identity in asymmetrically encrypted communication

Let's assume such a scenario. Person A will broadcast his public key and person B will broadcast his public key. They can now communicate. But let's say that suddenly another person C will write to ...
2 votes
2 answers
198 views

Is this RSA-based IBE Scheme secure?

The PKG performs the following steps Choose $p,q \in \mathbb{P}$. Calculate $N=pq$. Calculate $\phi (n)=(p-1)(q-1)$. Choose $e$ with $gcd(e,\phi(n))=1$ and $1 < e < \phi(n)$. Let it be $e = {p^{...
  • 53
0 votes
1 answer
52 views

Why has ID-based PKC not been included in the NIST PQC competition?

Although there are several proposals of ID-based PKC based on lattices, multivariate cryptography, I want to know why identity (ID) based PKC is not included in the NIST post-quantum competition. Is ...
  • 149
1 vote
0 answers
30 views

Is there a robust Identity-Based Digital Signature algorithm?

I'm looking for a IB-DS algorithm in the web. I found this one (if you know some other let me know). But I cannot figure out what the "identity" is. Better: I don't know if, in the section ...
  • 167
0 votes
0 answers
27 views

How to assert identity in a secure and non-copyable way?

Say I have the Mona Lisa, and I want to stick an RFID tag or similar mechanism on a back corner of the painting to verify this is the real Mona Lisa and any others are forgeries. What mechanism would ...
2 votes
0 answers
38 views

Is it secure to use the same master secret key in two independent IBE schemes?

Given two IBE schemes: Boneh-Franklin IBE scheme (https://doi.org/10.1007/3-540-44647-8_13) Secure under the CBDH problem (in the ROM) The master secret key is a random element in $\mathbb{Z}_p$ ...
  • 31
1 vote
0 answers
51 views

Cardinality of a set of successful hash values

Im trying to comprehend a proof from the paper "Efficient Identity Based Signature Schemes Based on Pairings"(2002) by Florian Hess. At one point of the proof for Theorem 2 I don't ...
0 votes
1 answer
46 views

Case Scenarios where Identity Based identification (IBI) Scheme can be employed

I was reading about identity based Identification scheme today. There are lot of articles and research paper on it. There is active research being done in this are of IBI schemes. My question is ...
2 votes
0 answers
35 views

Has the security of the IBS scheme suggested by Shamir in 1984 ever been proven?

My question is about the original IBE proposal by Shamir from 1984: https://link.springer.com/content/pdf/10.1007/3-540-39568-7_5.pdf In addition to proposing the idea of IBE, it also proposes a ...
1 vote
1 answer
89 views

Why is Boneh-Franklin IBE scheme secure? What should an adversary do to break it?

Even after reading their paper I am still not able to understand why the scheme is secure and what an adversary should do to break it. This question might look stupid to most of you but I don't have ...
1 vote
0 answers
39 views

How to prove to recipient that we are using public parameters correctly in lattice IBE

Many lattice IBE scheme follow the scheme outlined in ABB10. In ABB10, the ciphertext is $c_0 = u^\top s + x$, where $u$ is a public parameter. (No consider message here.) I want to ask: Is it ...
1 vote
0 answers
51 views

Artificial abort in Adaptively-secure Lattice IBE in [ABB10]

I have read the paper [ABB10] several times but I still cannot understand thoroughly the "artificial abort" in the security proof of the adaptively-secure IBE in the paper. So my questions ...
2 votes
1 answer
59 views

Crypto scheme to map data to users in a way that is anonymous to database server

I am trying to finish a paper on censorship resistant data-sharing systems in semi-centralized ways. I know the below threat model can be mitigated by using decentralized system, but I am looking for ...
0 votes
1 answer
93 views

Are there any existing open source implementations of "id-tied" public/private key encryption?

I don't quite know how to even ask the question for what I have in mind; but succinctly, I'm looking for some publicly implemented cryptosystem where messages for a user with id ...
  • 103
1 vote
0 answers
36 views

Is there an implemented Id-based key exchange protocol?

I need to use some kind of authentication of the client during my key exchange process. During my research, in this article I learned about identity-based key exchange and authentication, and I was ...
  • 11
0 votes
2 answers
185 views

How to prove that I am part of a list without revealing my identity?

Let's suppose and scenario like a secret voting scheme, at the ID verification step. Considerations: There is a public list of identities of people who are able to vote (ex, people who live in a ...
1 vote
0 answers
39 views

How to compute an identity function on encrypted vector by using a third party?

I want to compute an identity function over encrypted vector on a third party. For example, F(x) = [a1,a2,..,an] where x is a tag. However, i do not want the third ...
  • 61
2 votes
1 answer
129 views

Noise NK1 pattern identity hiding

In the official documentation for the Noise Framework there is a section with an overview of the identity hiding for each pattern. The numbering of properties there, obviously, from weaker properties ...
1 vote
1 answer
67 views

Dual system encryption:New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts

In the paper New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts from Waters and Lewko, how can the elements $R_3$ and $R'_3$ be eliminated in the decryption ...
2 votes
1 answer
111 views

What is the standard way to generate a unique non-reproducible ID?

Say that a manufacturer wants to label her products in such a way that a third party could verify that the manufacturer is the one that labeled the product, meaning it's not a counterfeit. The ...
  • 1,297
3 votes
1 answer
110 views

Identity Based Encryption: Known Random Value

Let's consider a situation whereby: Alice generates a ciphertext c from a message m using Bob’s ID. An attacker Carol can get c from the open channel. She knows that c is generated by using ...
3 votes
0 answers
102 views

Is it possible to verify attributes of encrypted content?

Let's say that Alice has this information about her, { "name": "Alice", "age": 25, "eyes": "brown" } which she encrypts with a key pair so that no one access ...
3 votes
0 answers
135 views

New Pairing Friendly Curves for SM9

A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)" SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-...
4 votes
0 answers
104 views

About Cocks IBE

Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $\mathbb{QR}_N$ in $\mathbb{Z}/N\mathbb{Z}$ to reduce the ciphertext expansion by half? I think it is also IND-ID-...
0 votes
1 answer
75 views

RIBE Scheme Implementation - How to encrypt message

This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU The encryption method specifies part of the encryption ...
  • 43
5 votes
1 answer
282 views

Can I replace DH by a post-quantum key exchange in IBAKE for post-quantum identity-based authenticated key exchange?

IETF RFC 6539 IBAKE - Identity Based Authenticated Key Exchange describes a Hybrid key exchange using both Identity based cryptography and a standard ephemeral elliptic curve Diffie-Hellman key ...
4 votes
3 answers
389 views

Is Identity-based encryption used in the wild?

I have a curious question. Is Identity-based encryption used in the wild?
  • 1,515
2 votes
1 answer
335 views

Can anyone elaborate why KP-ABE is better than CP-ABE for television program broadcasting?

I know the difference between KP-ABE and CP-ABE. I am not able to understand why KP-ABE is better for broadcasting than CP-ABE ?
  • 63
0 votes
2 answers
217 views

Difference between Identity-based encryption and multiple key-pairs of public key encryption?

What is the difference between Identity-based encryption and multiple key-pairs of public key encryption scheme?? Suppose trusted key generator generates a bunch of public and private key pairs $(k_{\...
  • 1,515
1 vote
1 answer
97 views

DecryptNode for non-leaf Node in CP-ABE

I've looked at paper Ciphertext-Policy Attribute-Based Encryption by Bethencourt, Sahai, Waters and see this an answer here for the explanation of DecrypNode for a ...
  • 151
1 vote
0 answers
35 views

identity based encryption-Private key [duplicate]

PKG will be sending the Private key,so it may not be secure,some one may get the private key,how to overcome this problem in IBE. Please help am unable to justify.
1 vote
0 answers
22 views

The semantic security in Anonymous Hierarchical identity-bases encryption?

In Anonymous Hierarchical Identity-Based Encryption (Without Random Oracles) by Boyen, to prove security it defined challenge ciphertext like I actually can't get how does the proof work? Why we ...
1 vote
3 answers
119 views

How to ask for an Identity confirmation without revealing

Let us say Alice has a list of public keys of her contacts. Bob wants to contact Ted and Bob has public key of Ted. Now, Is it possible to confirm that Alice has the same public key, without ...
2 votes
1 answer
365 views

How can I implement ID based encryption using RSA?

I want to implement ID based encryption using the RSA encryption algorithm but how can I edit the algorithm for IDs.
3 votes
1 answer
99 views

Enabling Oblivious Access Control via Function Encryption

Abstract With Functional Encryption, would access control between two parties be possible without revealing the entirety of one party's policy to the other? E.g. such that a server would be incapable ...
  • 201
1 vote
1 answer
70 views

What is the main difference between Anonymous HIBE and Anonymous Predicate Encryption?

What is the main difference between Anonymous HIBE and Anonymous Predicate Encryption? In my opinion, both work for the same concept in different ways.
1 vote
1 answer
500 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
11 votes
1 answer
271 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
  • 407
2 votes
1 answer
224 views

identity based cryptography (IBE) without key escrow

I am trying to find a method of implementing identity based cryptography to generate key pairs without the use of a trusted PKG that holds the private keys. Has there been any solutions to overcoming ...
  • 193
3 votes
2 answers
271 views

Are Koblitz curves paring friendly?

I want to implement an identity based encryption scheme using Koblitz curves as scalar multiplication is faster due to Frobrenius endomorphism. How can I tell if a curve over $\operatorname{GF}(2^m)$ ...
  • 59
3 votes
1 answer
122 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
3 votes
1 answer
86 views

Security of the server's private key

In some papers, server generates keys for users as follows: $$sk_i=msk+H(ID_i)v_i\ (mod \ p)$$ where $msk=$ the secret key of server $v_i$ is randomly selected from $Z_p$ for i-th user , $p$ is a ...
3 votes
2 answers
283 views

How are private keys handed to users in Identity-based Encryption?

I'm using IBE in my applied-crypto project in primitive form. I saw many articles about IBE, but didn't find how user can get private key is generated by PKG after EXTRACT method. So, my question: ...
  • 31
2 votes
1 answer
179 views

Why use symmetric encryption in a protocol like UPORT?

Reading the whitepaper UPORT: A PLATFORM FOR SELF-SOVEREIGN IDENTITY ~ DRAFT VERSION (2016-10-20) I noticed it states : Let A be an attestation. Suppose we wish to share this attestation with only ...
  • 123
1 vote
1 answer
130 views

Computational Assumption For the extended discrete logarithm

Choose randomly $P\in G_1, (s,a \in Z_q)$. let the attackers know $a,P$ and keep $s$ as secret. Also the following is given. $$sP,(a+s)^{-1}P$$ Individually, From $sP$, trying to reveal ($s$) will ...
  • 323