In this section, we discuss Cocks’ method and the Boneh-Gentry-Hamburg method.
9.1.1 Cocks’ IBE
An elegant solution to the problem of constructing an IBE was given by Cocks [70].
Briefly, the idea is the following. Our description is based on [40].
For a positive integer N, the set QR(N)consists of all quadratic residues modulo Nand J(N)is the set of all elements ofZZN having Jacobi symbol 1. An element in J(N)\QR(N)is a non-square having Jacobi symbol 1.
Set-Up. The public parameters of the system consists of N=pq(where p and q are primes such that factoring N is hard); a random u from J(N)\QR(N); and a hash function H()which maps identities into J(N). The master secret key is the factorization(p,q)of N.
KeyGen. The secret key corresponding to an identityidis obtained by first com- puting R=H(id)and then r to be either√
Ror √
uRaccording as R is a square modulo N or not. The secret key foridis r.
Encrypt. To encrypt a bit m (represented as+1 or−1) using an identityid, com- pute R fromidas above; randomly choose t0,t1fromZZNand for a∈ {0,1}compute da= (ta2+uaR)/taand ca=m·(tNa). The ciphertext consists of the two elements ((d0,c0),(d1,c1)).
Decrypt. For decryption using identityidand secret key r, first set a∈ {0,1}such that r2=uaR, where R is obtained fromid as above. Set g=da+2r. Note that g=(t
a+r)2 ta
and hence,(Ng) = (tNa). So, the receiver can compute m=ca·(Ng).
While this is an interesting protocol, one main problem with it is that the size of the ciphertext is very large. The overhead consists of two elements ofZZNper bit of the message.
The security of the system is based on the quadratic residuacity (QR) assump- tion under the random oracle model. The QR assumption is that given an element x of J(N)it is hard to determine whether x is actually a square modulo N, or whether it is a pseudo-square, i.e., it is a non-square modulo both p and q. If N can be fac-
tored into its constituent primes, then it is easy to solve the problem of determining the quadratic character of x. So, the hardness of the quadratic residuacity problem presupposes the hardness of the factoring problem.
9.1.2 Boneh-Gentry-Hamburg IBE
Boneh, Gentry and Hamburg [40] have given a non-pairing based IBE which is more space efficient compared to Cocks method. The construction is described in two parts. In the first part, an IBE is described which encrypts a single bit. This is a general description of which the Cocks-IBE is not an instantiation. In the second part, they show how to reuse the random elements for more than one bit. It is such reuse which significantly reduces the size of the ciphertext compared to Cocks’
scheme.
Below we describe the IBE from [40] for which the ciphertext length is⌈log2N⌉+ 2ℓ for an ℓ-bit message and N= pq as before. This construction is called Ba- sicIBE in [40]. Another construction is described for which the ciphertext is
⌈log2N⌉+ (ℓ+1)bits long. The description of this construction is omitted.
BasicIBE.
LetI Ddenote the identity space.
Set-Up. Let N=pq, where p and q are primes such that it is difficult to factorize N.
Choose a uniform random u from J(N)\QR(N). Let H :I D× {1, . . . , ℓ} →J(N) be a hash function which the security reduction models as a random oracle. The public parameters consists of(N,u,H). The master secret key is(p,q)along with a key K for a pseudo-random function FK :I D× {1, . . . , ℓ} → {0,1,2,3}.
KeyGen. The input consists of an identity id, the master secret key (p,q)and a message length parameter ℓ. The decryption key did corresponding to id is (r1, . . . ,rℓ)where the rj’s are obtained as follows.
For j=1, . . . , ℓdo Rj=H(id,j)∈J(N);
w=FK(id,j)∈ {0,1,2,3};
let a∈ {0,1}be such that uaRj∈QR(N);
let{z0,z1,z2,z3}be the four square roots of uaRjinZZN; set rj=zw;
end.
Encrypt. The input consists of the public parameters(N,u,H), an identityidand a message m=m1···mℓ∈ {−1,1}ℓ. Generate a uniform random s∈ZZN and set S =s2. The ciphertext is(S,c,c) where c= (c1, . . . ,cℓ) and c= (c1, . . . ,cℓ)and these are generated as follows.
For j=1, . . . , ℓdo Rj=H(id,j);
(f,g) =Q(N,Rj,S);
(f,g) =Q(N,uRj,S);
cj=mj·g(s)
N
; cj=mj·g(s)
N
; end.
Decrypt. The input is a ciphertext(S,c,c)encrypted to an identityidand the cor- responding decryption key did= (r1, . . . ,rℓ).
For j=1, . . . , ℓdo Rj=H(id,j);
if r2j=Rj
(f,g) =Q(N,Rj,S);
set mj=cj·f(r
j) N
; if r2j=uRj
(f,g) =Q(N,uRj,S);
set mj=cj·f(r
j) N
; end;
output m1. . . ,mℓ.
The function H generates elements in J(N). Given a function H′which generates elements in ZZN, it is easy to construct H. Fix a publicly known element z∈ZZN whose Jacobi symbol is−1 and let x=H′(id,j). Now return either x or zx as the output of H(id,j)according as whether the Jacobi symbol of x is 1 or−1.
The algorithm Q in the above description is a deterministic algorithm which takes three inputs – a positive integer N and two elements ofZZN and returns two polynomials f,gsatisfying the following conditions.
• If R and S are quadratic residues and r and s are respectively any square roots of Rand S, then f(r)g(s)is a quadratic residue.
• If R is a quadratic residue and r is any square root of R, then f(r)f(−r)S is a quadratic residue.
From the first condition, it follows that(f(r)/N)is equal to(g(s)/N). The sound- ness of decryption follows from this condition. The second condition is required for the security reduction to go through. The following example of Q has been described in [40]: given input(N,R,S), construct a solution(x,y)∈ZZ2Nto the equa- tion Rx2+Sy2=1 and output the polynomials f(r) =xr+1 and g(s) =2ys+2.
The main difficulty in the scheme is in finding a suitable solution(x,y). Several ap- proaches are described in [40], but, none of them are at the level of practicality for the accepted security level. Another approach to this problem is discussed in [111].