Questions tagged [identity-based-encryption]

In identity-based encryption (IBE) the public key of a user $A$ is some identity string $ID_A$, e.g., an email address. To encrypt a message for this user there is no need to retrieve an authentic copy of the public key, as it is in public key cryptography, but one can simply use the identity string $ID_A$.

Filter by
Sorted by
Tagged with
0
votes
1answer
37 views

Are there any existing open source implementations of “id-tied” public/private key encryption?

I don't quite know how to even ask the question for what I have in mind; but succinctly, I'm looking for some publicly implemented cryptosystem where messages for a user with id ...
1
vote
0answers
30 views

Is there an implemented Id-based key exchange protocol?

I need to use some kind of authentication of the client during my key exchange process. During my research, in this article I learned about identity-based key exchange and authentication, and I was ...
0
votes
2answers
77 views

How to prove that I am part of a list without revealing my identity?

Let's suppose and scenario like a secret voting scheme, at the ID verification step. Considerations: There is a public list of identities of people who are able to vote (ex, people who live in a ...
1
vote
0answers
30 views

How to compute an identity function on encrypted vector by using a third party?

I want to compute an identity function over encrypted vector on a third party. For example, F(x) = [a1,a2,..,an] where x is a tag. However, i do not want the third ...
1
vote
0answers
49 views

Noise NK1 pattern identity hiding

In the official documentation for the Noise Framework there is a section with an overview of the identity hiding for each pattern. The numbering of properties there, obviously, from weaker properties ...
1
vote
1answer
45 views

Dual system encryption:New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts

In the paper New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts from Waters and Lewko, how can the elements $R_3$ and $R'_3$ be eliminated in the decryption ...
0
votes
0answers
19 views

Regarding expansion of one equation in “Attribute based signature and its applications”

This is regarding one equation in paper titled "Attribute based signature and its applications" by Jin Li. Link: https://dl.acm.org/doi/10.1145/1755688.1755697 Can somebody help me in understanding ...
2
votes
1answer
54 views

What is the standard way to generate a unique non-reproducible ID?

Say that a manufacturer wants to label her products in such a way that a third party could verify that the manufacturer is the one that labeled the product, meaning it's not a counterfeit. The ...
0
votes
0answers
35 views

The implementation of Lattice-based HIBE

There are many lattice-based scheme papers adopt the lattice basis delegate technical from Agrawal et al. But I can't find the relevant implementation on the Internet since 2010. In fact, I almost ...
3
votes
1answer
85 views

Identity Based Encryption: Known Random Value

Let's consider a situation whereby: Alice generates a ciphertext c from a message m using Bob’s ID. An attacker Carol can get c from the open channel. She knows that c is generated by using ...
2
votes
0answers
88 views

Is it possible to verify attributes of encrypted content?

Let's say that Alice has this information about her, { "name": "Alice", "age": 25, "eyes": "brown" } which she encrypts with a key pair so that no one access ...
3
votes
0answers
107 views

New Pairing Friendly Curves for SM9

A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)" SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-...
4
votes
0answers
91 views

About Cocks IBE

Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $\mathbb{QR}_N$ in $\mathbb{Z}/N\mathbb{Z}$ to reduce the ciphertext expansion by half? I think it is also IND-ID-...
0
votes
1answer
61 views

RIBE Scheme Implementation - How to encrypt message

This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU The encryption method specifies part of the encryption ...
5
votes
1answer
165 views

Can I replace DH by a post-quantum key exchange in IBAKE for post-quantum identity-based authenticated key exchange?

IETF RFC 6539 IBAKE - Identity Based Authenticated Key Exchange describes a Hybrid key exchange using both Identity based cryptography and a standard ephemeral elliptic curve Diffie-Hellman key ...
4
votes
3answers
279 views

Is Identity-based encryption used in the wild?

I have a curious question. Is Identity-based encryption used in the wild?
2
votes
1answer
151 views

Can anyone elaborate why KP-ABE is better than CP-ABE for television program broadcasting?

I know the difference between KP-ABE and CP-ABE. I am not able to understand why KP-ABE is better for broadcasting than CP-ABE ?
0
votes
2answers
150 views

Difference between Identity-based encryption and multiple key-pairs of public key encryption?

What is the difference between Identity-based encryption and multiple key-pairs of public key encryption scheme?? Suppose trusted key generator generates a bunch of public and private key pairs $(k_{\...
0
votes
1answer
69 views

DecryptNode for non-leaf Node in CP-ABE

I've looked at paper Ciphertext-Policy Attribute-Based Encryption by Bethencourt, Sahai, Waters and see this an answer here for the explanation of DecrypNode for a ...
1
vote
0answers
35 views

identity based encryption-Private key [duplicate]

PKG will be sending the Private key,so it may not be secure,some one may get the private key,how to overcome this problem in IBE. Please help am unable to justify.
1
vote
0answers
20 views

The semantic security in Anonymous Hierarchical identity-bases encryption?

In Anonymous Hierarchical Identity-Based Encryption (Without Random Oracles) by Boyen, to prove security it defined challenge ciphertext like I actually can't get how does the proof work? Why we ...
1
vote
3answers
99 views

How to ask for an Identity confirmation without revealing

Let us say Alice has a list of public keys of her contacts. Bob wants to contact Ted and Bob has public key of Ted. Now, Is it possible to confirm that Alice has the same public key, without ...
1
vote
1answer
292 views

How can I implement ID based encryption using RSA?

I want to implement ID based encryption using the RSA encryption algorithm but how can I edit the algorithm for IDs.
3
votes
1answer
78 views

Enabling Oblivious Access Control via Function Encryption

Abstract With Functional Encryption, would access control between two parties be possible without revealing the entirety of one party's policy to the other? E.g. such that a server would be incapable ...
1
vote
1answer
415 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
11
votes
1answer
225 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
1
vote
1answer
200 views

identity based cryptography (IBE) without key escrow

I am trying to find a method of implementing identity based cryptography to generate key pairs without the use of a trusted PKG that holds the private keys. Has there been any solutions to overcoming ...
2
votes
2answers
253 views

Are Koblitz curves paring friendly?

I want to implement an identity based encryption scheme using Koblitz curves as scalar multiplication is faster due to Frobrenius endomorphism. How can I tell if a curve over $\operatorname{GF}(2^m)$ ...
3
votes
1answer
111 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
3
votes
1answer
78 views

Security of the server's private key

In some papers, server generates keys for users as follows: $$sk_i=msk+H(ID_i)v_i\ (mod \ p)$$ where $msk=$ the secret key of server $v_i$ is randomly selected from $Z_p$ for i-th user , $p$ is a ...
3
votes
2answers
250 views

How are private keys handed to users in Identity-based Encryption?

I'm using IBE in my applied-crypto project in primitive form. I saw many articles about IBE, but didn't find how user can get private key is generated by PKG after EXTRACT method. So, my question: ...
2
votes
1answer
170 views

Why use symmetric encryption in a protocol like UPORT?

Reading the whitepaper UPORT: A PLATFORM FOR SELF-SOVEREIGN IDENTITY ~ DRAFT VERSION (2016-10-20) I noticed it states : Let A be an attestation. Suppose we wish to share this attestation with only ...
1
vote
1answer
113 views

Computational Assumption For the extended discrete logarithm

Choose randomly $P\in G_1, (s,a \in Z_q)$. let the attackers know $a,P$ and keep $s$ as secret. Also the following is given. $$sP,(a+s)^{-1}P$$ Individually, From $sP$, trying to reveal ($s$) will ...
1
vote
1answer
87 views

Can I use computational diffie hellman problem in the following scheme?

Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$ $X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public. $m,n,r$ are randomly chosen from $Z_q$. Anybody who knows $(1/r)$ can ...
1
vote
1answer
49 views

Selecting secret value in certificateless identity-based encryption

In certificateless identity-based cryptography, selecting secret value $$x_i \in Z_p$$ and declaring public key of individual users such as $$Pub_i=g^{x_i}$$ $g$ is public parameter. I think there ...
2
votes
1answer
111 views

Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security?

OK, I am confused. Does it mean that that the various anonymous multi-receiver IBE implementations actually do not have single public key per Identity, as as is the in the original IBE implementation? ...
3
votes
1answer
91 views

How to distribute system parameters in identity-based encryption

Identity-based encryption papers describe that system parameters are declared as public. However,in real scenario, how to distribute system parameters to users?
3
votes
1answer
174 views

Why is the simulation required in these identity-based encryption security proofs?

In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses ...
1
vote
0answers
47 views

Some Question about Security Proof of authenticated identity-based encryption

In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding. In key extraction queries,if attacker request for guessed ID, then B fails....
0
votes
1answer
142 views

Advantage of attacker in CPA secure IBE

In CPA secure IBE systems, the advantage of attacker (A) is defined as absolute value of $$Pr[b=b^{'}]-\frac{1}{2}$$ Can someone please explain this to me in a few words? Where exactly does that ...
1
vote
0answers
108 views

Why security proof uses random oracles in identity-based encryption?

In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the ...
0
votes
0answers
50 views

Decryption Queries and its meaning in identity-based encryption

In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need ...
1
vote
1answer
53 views

What are the benefits of being able to choose (most of) the public key in a PKC?

We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue). However, we have a ...
0
votes
0answers
42 views

Why not consider modification in ciphertext part in identity-based encryption

In identity-based broadcast encryption system, the ciphertext is $$ C=<c1,c2,...,cn,U,V,W>$$ There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the ...
1
vote
0answers
67 views

Anonymous Identity-based broadcast encryption use single common key or different keys

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ ...
0
votes
0answers
39 views

Notation of * in hash function of identity-based encryption

$H:\{0,1\}^{*} \rightarrow Z_{p}^{*}$ $H:\{0,1\}^{*} \rightarrow Z_{p}$ $H:\{0,1\}^{*} \rightarrow G_{1}^{*}$ $H:\{0,1\}^{*} \rightarrow G_{1}$ Difference meaning of $Z_{p}^{*}, Z_{p},G_{1}^{...
0
votes
1answer
125 views

Hash Function representation in identity-based encryption

Some describe as $H:F_{q}\times G_{2}\rightarrow \{0,1\}^{n}$.Some describe as $H:\{0,1\}^{*}\times\{0,1\}^{*}\rightarrow F_{q}$. What is the meaning of product function? what kind of operation does ...
2
votes
2answers
128 views

Security (CPA?,CCA?) in Authenticated identity-based encryption

When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where: $$a=e(d_{A},B)$$ $$s=H_{3}(Msg,K)$$ $$C=<s,\gamma \oplus H_{2}(a,s),H_{4(...
1
vote
1answer
46 views

Which one is correct probability formula for the same master secret value in identity-based encryption

Assume two servers $(n=2)$ use the same domain curve parameters and same hash function $H:\{0,1\}^{*} \rightarrow G_{1}$ . Then the hash value for the same identity falls in same result and let it be ...
3
votes
1answer
54 views

Concept of “guessed ID” in Authenticated Identity-Based Encryption

In Authenticated Identity-Based Encryption by Ben Lynn, in Proof of Integrity (section 4.3) and Proof of Security (section 4.4), I cannot grab the concept of "guessed ID" . Because encryption differs ...