9

I am just going to answer regarding identity-based encryption (IBE): I don't know much about the situation for attribute-based encryption. Also, I am just answering based on today's situation: recent IBE constructions may prove to be very efficient (or not) in the future, and if you want to consider only post-quantum schemes you will have to discard IBEs ...


8

Simple answer: you cannot. Identity-based encryption is an advanced cryptographic primitive, you cannot simply take any existing encryption algorithm and make it identity-based with simple modifications. There exists several constructions of IBE, but they all strongly differ from the standard RSA algorithm. You can find more information on the wikipedia page....


7

Public key crypto vs. identity-based crypto made short: In traditional public key cryptography, a user $A$ generates a private/public key pair $(sk_A,pk_A)$ and since this key pair has absolutely no indication to which indentity (user $A$) it belongs, it is necessary to certify the public key, i.e., bind the public key $pk_A$ to the user $A$'s identity. ...


6

PE is a subclass of FE. This (from the other answer) is correct. Also, from my understanding, your analogy is correct. PE returns the plaintext if the predicate evaluates to true. FE, on the other hand, returns a function of the plaintext. We can say that PE is a subclass of FE, since we can use FE to implement PE. Just use the identity function. Your ...


6

Zero-knowledge proofs of knowledge basically allow Alice to convince someone beyond a reasonable doubt that she knows a certain piece of information (i.e., the answer to a certain question), without revealing what exactly that information is. One simple example involves the discrete logarithm problem, which you might be familiar with: given a (large) prime $...


6

She can generate a key-pair and include the public key in the book. Having the private counterpart she can at any time proove that she wrote the book by signing an arbitrary statament.


5

In real world applications Attribute-based Encryption (ABE) is used in conjunction with a symmetric cipher, because you can only encrypt group elements with ABE. In this case it is the multiplicative group $G_T$. The number of bits is limited when you try to represent text messages (bit strings) with a group element, because the size of the group is derived ...


5

There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write it additively $e(aP,bQ)=e(P,Q)^{ab}$. This comes from the fact that in $e : \mathbb{G}_1\times \mathbb{G}_2\to\mathbb{G}_T$, $\mathbb{G}_1$ and $\mathbb{G}_2$ ...


5

To quote yyyyyyy from the comments: The $_R$ has nothing to do with the field — it is associated to $\in$! To quote your first link: "For a set $S$, by $a\in_R S$, we mean that $a$ is randomly chosen from $S$." and to quote SEJPM from the comments: If $p\in \mathbb P$ (with $\mathbb P$ being the set of all primes) then the notations $GF(p);\...


5

Crypto is nice and clean until you think about how to manage the keys. Common Identity-based Encryption (IBE) schemes have a tremendous disadvantage, that a trusted key authority generates private keys for some user and the user has to be given that key. The most common scenario for IBE is a corporate environment, so I will only ways to solve that in that ...


4

PE is a subclass of FE. A description can be found on page 256 of the book “Theory of Cryptography: 8th Theory of Cryptography Conference, TCC 2011”. The related paper is available in PDF format via eprint.iacr.org: Functional Encryption: Definitions and Challenges Dan Boneh, Amit Sahai, Brent Waters


4

First, recall that in a chosen-ciphertext attack (CCA) model, the attacker has access to a decryption oracle. A scheme is said CCA-secure if access to a decryption oracle does not give any advantage to the attacker. Knowing this, a very simple CCA attack can be done on BasicIdent. I will use the description of the scheme from Wikipedia. As you can see, ...


4

The problem can be simplified to the following problem, since the standard argument doesn't really take into account that you can't generate all the polynomials of the given maximum degree : Assume that we have sampled a random point $\vec{x}\in \mathbb{F}_p^n$. We let an adversary adaptively choose polynomials of degree at most $d$ and after each choice ...


4

First of all, let us simplify the equation by replacing things that the attacker can compute with known constants. We come up with: $$a \cdot b^x = y$$ where the attacker knows $a$ (which is $e(g,h)^k$) and $b$ (which is $e(g, h)$, which he can compute, as he knows $g, h$), and the attacker solves for $x, y$. If it is sufficient for an attacker to find a ...


4

The authors describe it that way because the functions operate on different inputs and produce different outputs. In your first example $H$ outputs an $n$ bit string, while in the second $H$ outputs an element of the field $F_q$. Clearly, one can represent an element of a field $F_q$ by a bitstring of size $n$ for some $n$ (using some suitable encoding). ...


4

(I assume you are asking about this paper based on your previous questions.) They do not prove BDDH in their security proofs. Assume that an attacker $A$ breaks IND-sMID-CPA of the above scheme with probability greater than $\epsilon$ within time $t$ [...]. We show that using $A$, one can construct an attacker $B$ for solving the BDDH problem. In ...


4

Let $q$ be the base field cardinal; in your case, $q = 2^m$ for some integer $m$. We need $m$ to be prime for a Koblitz curve, otherwise the curve would also be defined on non-trivial sub-fields, allowing for faster discrete logarithm. For a "pairing-friendly curve", we need the curve order to be a multiple of a prime $r$, and the pairing produces outputs in ...


3

In general, encryption schemes are not suitable for signatures. The misconception may stem from the symmetricity of operations in RSA encryption and decryption, which allows the core scheme to be easily used for signing as well. That being said, all identity-based encryption schemes (IBE) can be used as general signature schemes, see e.g. Boneh & ...


3

It is very hard to give a concrete, "apples-to-apples" comparison of lattice-based and pairing-based IBE schemes. There are many reasons: the research surrounding concrete secure parameters for LWE is still evolving, efficient implementations of operations used in lattice-based IBE (e.g., discrete Gaussian sampling) are still works in progress, one can ...


3

The BSW07 CP-ABE scheme is a pairing based construction. Denoting the pairing as $e:G\times G\rightarrow G_T$ (symmetric notation for simplicity), the message space of this scheme is the prime order $q$ group $G_T$, which in practice is a prime order $q$ subgroup of the multiplicative group of some finite field. Consequently, if you have a message $m$ and ...


3

The problem that arises in the security proof is that the adversary who may win the real game with some probability may however cause the simulation to nearly always abort (by issuing a private key query that requires the simulation to abort) and the probability of an abort may be different for different sets of private key queries. So, the problem is that ...


3

It's been a while since I've read this paper, and I remember having a lot of trouble with this derivation. I'm sure there is an easy way to see it, but I don't see it, so I'll just brute force through with the algabra. First, some context: When the simulator is given a random element as the last term in the tuple the simulator will either abort (and ...


3

With IBE the public key is a public bitstring as your email. A Key-authority issues a secret key that is tied with this public key.The owner of the secret key can only decrypt. ABE entails more complex access control on decryption operation such as:"Only the owner of the secret key that corresponds to: Area:=Italy AND Age:<30 and Business:=Researcher" ...


3

I am really not sure about what you are trying to do. If you simply want to prove that $Ans = e(g,h)^k \times e(g,h)^r$ is hidden given only $(g,h,e(g,h)^k)$, then this is trivial and does not require any hypothesis at all (in particular, no discrete logarithm problem is involved). Indeed, this is perfectly equivalent to the problem of finding $e(g,h)^r$ ...


2

You can probably prove the security against your game from the security in the IND-ID-CCA game of Boneh and Franklin (see http://courses.cs.vt.edu/cs6204/Privacy-Security/Papers/Crypto/IBE-Weil-Pairing.pdf). The idea is to create an adversary $\mathcal{B}$ against IND-ID-CCA from your adversary $\mathcal{A}$. Essentially $\mathcal{B}$ will play man-in-the-...


2

What you are describing is an anonymous credential system. There are two different ways to go about making these and two actual systems that use those techniques: Microsoft's U-prove and IBM's Idemix. If you're interested in smart card usage, you'd probably prefer U-prove as it tends to work better with smart cards. It's described by its original ...


2

Layering your encryption mechanisms like that would not display collusion-resistance between the two schemes. For example, someone with an Org-A key could decrypt the outer encryption over a record designated for Org-A administrators and then pass the inner ciphertext to someone with an Administrator key. Of course, you could use a different key for each Org'...


2

The Extract phase is performed by the Private Key Generator (PKG). Note that in IBE it is not necessary a Public Key Generator, since public keys are just arbitrary bit strings or "identities". So, to sum up: Setup, executed by the PKG. This algorithm creates, among other things, a master key for the PKG. Extract, executed by the PKG. This algorithm enables ...


Only top voted, non community-wiki answers of a minimum length are eligible