Questions tagged [identity-based-encryption]

In identity-based encryption (IBE) the public key of a user $A$ is some identity string $ID_A$, e.g., an email address. To encrypt a message for this user there is no need to retrieve an authentic copy of the public key, as it is in public key cryptography, but one can simply use the identity string $ID_A$.

Filter by
Sorted by
Tagged with
0
votes
1answer
67 views

DecryptNode for non-leaf Node in CP-ABE

I've looked at paper Ciphertext-Policy Attribute-Based Encryption by Bethencourt, Sahai, Waters and see this an answer here for the explanation of DecrypNode for a ...
3
votes
0answers
96 views

New Pairing Friendly Curves for SM9

A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)" SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-...
1
vote
0answers
29 views

How to compute an identity function on encrypted vector by using a third party?

I want to compute an identity function over encrypted vector on a third party. For example, F(x) = [a1,a2,..,an] where x is a tag. However, i do not want the third ...
1
vote
0answers
42 views

Noise NK1 pattern identity hiding

In the official documentation for the Noise Framework there is a section with an overview of the identity hiding for each pattern. The numbering of properties there, obviously, from weaker properties ...
1
vote
1answer
43 views

Dual system encryption:New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts

In the paper New Techniques for Dual System Encryption and Fully Secure HIBE with Short Ciphertexts from Waters and Lewko, how can the elements $R_3$ and $R'_3$ be eliminated in the decryption ...
0
votes
0answers
19 views

Regarding expansion of one equation in “Attribute based signature and its applications”

This is regarding one equation in paper titled "Attribute based signature and its applications" by Jin Li. Link: https://dl.acm.org/doi/10.1145/1755688.1755697 Can somebody help me in understanding ...
3
votes
1answer
80 views

Identity Based Encryption: Known Random Value

Let's consider a situation whereby: Alice generates a ciphertext c from a message m using Bob’s ID. An attacker Carol can get c from the open channel. She knows that c is generated by using ...
2
votes
1answer
133 views

Can anyone elaborate why KP-ABE is better than CP-ABE for television program broadcasting?

I know the difference between KP-ABE and CP-ABE. I am not able to understand why KP-ABE is better for broadcasting than CP-ABE ?
0
votes
2answers
146 views

Difference between Identity-based encryption and multiple key-pairs of public key encryption?

What is the difference between Identity-based encryption and multiple key-pairs of public key encryption scheme?? Suppose trusted key generator generates a bunch of public and private key pairs $(k_{\...
2
votes
1answer
52 views

What is the standard way to generate a unique non-reproducible ID?

Say that a manufacturer wants to label her products in such a way that a third party could verify that the manufacturer is the one that labeled the product, meaning it's not a counterfeit. The ...
0
votes
0answers
32 views

The implementation of Lattice-based HIBE

There are many lattice-based scheme papers adopt the lattice basis delegate technical from Agrawal et al. But I can't find the relevant implementation on the Internet since 2010. In fact, I almost ...
1
vote
0answers
144 views

Could MITM securely identify identity?

Consider protocol like QUIC or MinimaLT which are essentially layer4 replacement for TCP/UDP (riding on top of UDP currently because of fear of random firewalls dropping new L4 protocol). From crypto ...
2
votes
0answers
86 views

Is it possible to verify attributes of encrypted content?

Let's say that Alice has this information about her, { "name": "Alice", "age": 25, "eyes": "brown" } which she encrypts with a key pair so that no one access ...
5
votes
1answer
163 views

Can I replace DH by a post-quantum key exchange in IBAKE for post-quantum identity-based authenticated key exchange?

IETF RFC 6539 IBAKE - Identity Based Authenticated Key Exchange describes a Hybrid key exchange using both Identity based cryptography and a standard ephemeral elliptic curve Diffie-Hellman key ...
4
votes
0answers
90 views

About Cocks IBE

Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $\mathbb{QR}_N$ in $\mathbb{Z}/N\mathbb{Z}$ to reduce the ciphertext expansion by half? I think it is also IND-ID-...
0
votes
1answer
60 views

RIBE Scheme Implementation - How to encrypt message

This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU The encryption method specifies part of the encryption ...
4
votes
3answers
270 views

Is Identity-based encryption used in the wild?

I have a curious question. Is Identity-based encryption used in the wild?
1
vote
0answers
35 views

identity based encryption-Private key [duplicate]

PKG will be sending the Private key,so it may not be secure,some one may get the private key,how to overcome this problem in IBE. Please help am unable to justify.
6
votes
1answer
175 views

How to select corresponding ciphertext in anonymous Identity-based broadcast encryption?

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. It does not describe which user corresponds to which ciphertext part. User ...
1
vote
3answers
97 views

How to ask for an Identity confirmation without revealing

Let us say Alice has a list of public keys of her contacts. Bob wants to contact Ted and Bob has public key of Ted. Now, Is it possible to confirm that Alice has the same public key, without ...
1
vote
0answers
20 views

The semantic security in Anonymous Hierarchical identity-bases encryption?

In Anonymous Hierarchical Identity-Based Encryption (Without Random Oracles) by Boyen, to prove security it defined challenge ciphertext like I actually can't get how does the proof work? Why we ...
1
vote
1answer
289 views

How can I implement ID based encryption using RSA?

I want to implement ID based encryption using the RSA encryption algorithm but how can I edit the algorithm for IDs.
8
votes
4answers
3k views

Is there any semantic difference between predicate encryption and functional encryption?

Predicate encryption(PE) arrived as a descendant of attribute based encryption. Attribute based encryption allows the encryptor to embody a policy to the ciphertext (Ciphertext-Policy based encryption)...
3
votes
1answer
76 views

Enabling Oblivious Access Control via Function Encryption

Abstract With Functional Encryption, would access control between two parties be possible without revealing the entirety of one party's policy to the other? E.g. such that a server would be incapable ...
1
vote
1answer
408 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
2
votes
1answer
443 views

Pairings in Identity-based encryption vs. Attribute-based encryption

The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and $e:...
3
votes
1answer
110 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
11
votes
1answer
222 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
3
votes
1answer
93 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
1
vote
1answer
196 views

identity based cryptography (IBE) without key escrow

I am trying to find a method of implementing identity based cryptography to generate key pairs without the use of a trusted PKG that holds the private keys. Has there been any solutions to overcoming ...
1
vote
2answers
460 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
2
votes
2answers
251 views

Are Koblitz curves paring friendly?

I want to implement an identity based encryption scheme using Koblitz curves as scalar multiplication is faster due to Frobrenius endomorphism. How can I tell if a curve over $\operatorname{GF}(2^m)$ ...
1
vote
1answer
391 views

Is it feasible to use combination of ABE schemes for encrypting the data?

I have a peculiar requirement for preserving the shared log files. For example I have 1000 records which belong to different organizations as listed below and all the logs are present in a single CSV ...
2
votes
1answer
110 views

Anonymous Multi-Receiver Identity-Based Authenticated Encryption with CCA Security?

OK, I am confused. Does it mean that that the various anonymous multi-receiver IBE implementations actually do not have single public key per Identity, as as is the in the original IBE implementation? ...
3
votes
1answer
78 views

Security of the server's private key

In some papers, server generates keys for users as follows: $$sk_i=msk+H(ID_i)v_i\ (mod \ p)$$ where $msk=$ the secret key of server $v_i$ is randomly selected from $Z_p$ for i-th user , $p$ is a ...
3
votes
2answers
247 views

How are private keys handed to users in Identity-based Encryption?

I'm using IBE in my applied-crypto project in primitive form. I saw many articles about IBE, but didn't find how user can get private key is generated by PKG after EXTRACT method. So, my question: ...
1
vote
1answer
87 views

Can I use computational diffie hellman problem in the following scheme?

Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$ $X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public. $m,n,r$ are randomly chosen from $Z_q$. Anybody who knows $(1/r)$ can ...
2
votes
1answer
170 views

Why use symmetric encryption in a protocol like UPORT?

Reading the whitepaper UPORT: A PLATFORM FOR SELF-SOVEREIGN IDENTITY ~ DRAFT VERSION (2016-10-20) I noticed it states : Let A be an attestation. Suppose we wish to share this attestation with only ...
1
vote
1answer
111 views

Computational Assumption For the extended discrete logarithm

Choose randomly $P\in G_1, (s,a \in Z_q)$. let the attackers know $a,P$ and keep $s$ as secret. Also the following is given. $$sP,(a+s)^{-1}P$$ Individually, From $sP$, trying to reveal ($s$) will ...
1
vote
1answer
48 views

Selecting secret value in certificateless identity-based encryption

In certificateless identity-based cryptography, selecting secret value $$x_i \in Z_p$$ and declaring public key of individual users such as $$Pub_i=g^{x_i}$$ $g$ is public parameter. I think there ...
1
vote
1answer
121 views

How should I define order according to domain parameters in elliptic curve pairing groups?

According to domain parameters, as an example Type 1 pairing domain parameters are ...
3
votes
1answer
90 views

How to distribute system parameters in identity-based encryption

Identity-based encryption papers describe that system parameters are declared as public. However,in real scenario, how to distribute system parameters to users?
3
votes
1answer
172 views

Why is the simulation required in these identity-based encryption security proofs?

In identity-based encryption papers (i.e.this) it is very difficult for me to understand security proof. I don't know why they prove assumption (BDH, BDDH) for security of their scheme. Some uses ...
1
vote
0answers
108 views

Why security proof uses random oracles in identity-based encryption?

In identity-based encryption, users decrypt the ciphertext by using private keys. Without private key, no one will be able to decrypt.In security proofs like here, random oracles are used with the ...
1
vote
0answers
45 views

Some Question about Security Proof of authenticated identity-based encryption

In authenticated identity-based encryption by Benn Lynn, in proof of security, I have a little difficulties in understanding. In key extraction queries,if attacker request for guessed ID, then B fails....
0
votes
1answer
132 views

Advantage of attacker in CPA secure IBE

In CPA secure IBE systems, the advantage of attacker (A) is defined as absolute value of $$Pr[b=b^{'}]-\frac{1}{2}$$ Can someone please explain this to me in a few words? Where exactly does that ...
0
votes
0answers
42 views

Why not consider modification in ciphertext part in identity-based encryption

In identity-based broadcast encryption system, the ciphertext is $$ C=<c1,c2,...,cn,U,V,W>$$ There can be a man-in-the-middle who can modify one or all of the $c1,c2,...,cn$ values so that the ...
0
votes
0answers
50 views

Decryption Queries and its meaning in identity-based encryption

In identity-based encryption, for security proof, they sometimes describe random oracle for decryption queries. Therefore, I wonder decryption is handled by decryption oracle for all users? Users need ...
1
vote
1answer
53 views

What are the benefits of being able to choose (most of) the public key in a PKC?

We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue). However, we have a ...
1
vote
0answers
66 views

Anonymous Identity-based broadcast encryption use single common key or different keys

In identity-based broadcast encryption, suppose the broadcast ciphertext $(r_1,r_2,\dots,r_i,U,W,V)$ is sent to the receiver. In some cases, they use some function $f(x)=k-\prod_{i=1}^{t} (x-v_{i})$ ...