In 1984, Shamir [88] (the ‘S’ in RSA) proposed the first identity-based signature scheme and outlined a solution to this key distribution / certificate management problem calling it Identity Based Encryption (IBE). However, he didn’t have an implementation.
The idea was that if any string can be a public key, then one could use an identifier of the recipient to be the public key in which case one doesn’t need to locate the public key associated with an identity. The identity is the key. Furthermore, one can use the “identifier string” combined with something like a date/time and encrypt messages to be read into the future.
Our friends Alice and Bob are to communicate in this system. Bob can simply use Alice’s email address ([email protected]) and the public parameters of a trusted third party as the public key to encrypt the message. When Alice receives the message, she contacts the trusted third party (KDC key distribution center), validates herself and receives the private key associated with her identity.
Shamir’s proposed IBE remained an elusive “holy grail” for cryptographers until Cocks [22] working at the British secret service GCHQ discovered a method relying on quadratic
CHAPTER 2. CRYPTO 101
residues. Unfortunately this method is impractical for widespread use because of the band- width overheads. It has recently come to light that two Japanese researchers Sakai and Kasahara [81] also made a significant discovery relevant to IBE using pairings but due to language barriers their implementation wasn’t widely known.
In 2001, Boneh and Franklin [14] announced a more viable method using the Weil pairing (See. 2.4.3) This method, while demonstrable, still lacked a pragmatic implementation which could be considered widely usable. Optimizations of the pairing mathematics were proposed by Barreto-Kim-Lynn-Scott [2] in 2002 which moved the processing overheads close to that of the widely used RSA algorithm. These optimizations involved
• Point tripling for super-singular elliptic curves over F3m.
• Removal of irrelevant operations from conventional algorithms.
Background
An IBE system involves, using the language of Boneh & Franklin’s seminal paper2 a set of four algorithms.
Setup: A key generator (KDC) which runs a ‘setup’ algorithm to generate global system parameters and a master-key which the KDC keep safe. The whole security of the system relies on the safekeeping of this master-key in a device sich as a hardware security module.
Extract: The KDC runs an extract algorithm inputting the user’s identity (or any bit string) and using the master-key from the setup. The output is the users private-key associated with the users identity. Its important that the private-key is transported to the user in a safe manner and that the KDC has made a full examination of the user credentials before issuing a key corresponding to those credentials.
Encrypt: A probabilistic algorithm. Any user encrypts using the global system parameters and public key ID. The output is the ciphertext.
Decrypt: This process takes the ciphertext from the encrypt function, global system pa- rameters and the private key issued by the KDC. The output is the corresponding plaintext.
Boneh & Franklin’s paper provides a random oracle security proof for their IBE method. Hence, it is secure against an adaptive chosen ciphertext attack assuming the hardness of the so-called Bilinear Diffie Hellman problem.
Technical
The following description is from Mao [63].
Set-up
1. Generate two groups G1, G2 of prime order q and a mapping-in-pair e : G12 → G2.
choose P and element in G1.
2. Pick s ∈∪ Zq and set Ppub← [s]P ; s is the master key.
3. Using a strong hash algorithm F : {0, 1}∗→ G1. to map the identity string ID to an
element in G1.
4. Specify another suitable hash algorithm H : G2→ {0, 1}n.
The KDC keeps s as the system master-key and publishes the parameters.
(G1, G2, e, n, P, Ppub, F, H)
Private Key Generation (= Extract)
Let ID denote an authenticated and validated user’s identity (it can be any string) 1. Compute QID ← F (ID). This is an element in G1 and is the users public key.
2. Set the users private key dID as [s]QID.
Encryption
To send an encrypted message, obtain the system parameters (G1, G2, e, n, P, Ppub, F, H).
CHAPTER 2. CRYPTO 101
gID ← e(QID, [r]Ppub) ∈ G2,
The ciphertext is C ← ([r]P, ML H(gID)).
Decryption
To decrypt C using ID’s private key dID as [s]QID, compute M = V L H(e(dID, U )).
Other “hard problems”
As mentioned above the Diffie-Hellman (DH) tuple in G1 is a tuple (P, xP, yP, zP ) ∈ G41
for some x, y, z chosen at random from Zq satisfying z = xy mod q.
Computational Diffie-Hellman (CDH) problem: Given the first three elements in a DH tuple, compute the remaining element. The CDH assumption: no algorithm exists running in expected polynomial time which can solve the CDH problem with non-negligible probability.
Decision Diffie-Hellman (DDH) problem: Given a tuple (P, xP, yP, zP ) ∈ G41 for
some x, y, z chosen at random from Zq, decide if it is a valid DH tuple. If a pairing can be calculated then this can be solved in polynomial time by verifying the equation ˆ
e(xP, yP ) = ˆe(P, zP ).. Note that this is contrast to the situation in the simple finite field where the DDH problem is also complex. This is also difficult on an elliptic curve if a pairing cannot be calculated; that is if the elliptic curve is not pairing-friendly.
Bilinear Diffie-Hellman (BDH) problem: Let P be a generator of G1. The BDH
problem in G1, G2, ˆe is given (P, xP, yP, zP ) ∈ G41 for some x, y, z chosen at random
from Zq, compute W = ˆe(P, P )xyz ∈ G2.
The following description of multi-precision algorithms is primarily derived from the Handbook of Elliptic and Hyperelliptic Cryptography ([23] Chapters 10 and 11), and the Handbook of Applied Cryptography ([67] Chapter 14). However, it is equally well presented in Crandall ([27] Chapter 9), Smart ([91] Chapter 11 Section 11.5), and Rodr´ıguez-Henr´ıquez et al ([79] Chapter 5).