Hierarchical Identity Based Encryption with Constant Size Ciphertext

Abstract

Abstract. We present a Hierarchical Identity Based Encryption (HIBE) system where the ciphertext consists of just three group elements and decryption requires only two bilinear map computations, regardless of the hierarchy depth. Encryption is as efficient as in other HIBE systems. We prove that the scheme is selective-ID secure in the standard model and fully secure in the random oracle model. Our system has a number of applications: it gives very efficient forward secure public key and identity based cryptosystems (with short ciphertexts), it converts the NNL broadcast encryption system into an efficient public key broadcast system, and it provides an efficient mechanism for encrypting to the future. The system also supports limited delegation where users can be given restricted private keys that only allow delegation to bounded depth. The HIBE system can be modified to support sublinear size private keys at the cost of some ciphertext expansion.

Collusion Resistant Broadcast Encryption with Short Ciphertexts and Private Keys

“…Furthermore, Boneh et al [BBG05] show that the -BDHE assumption holds in generic bilinear groups [Sho97].…”

Doubly spatial encryption from DBDH

“…This turns out to be completely insecure; one way to see this is that an adversary can take linear combinations of the rows in X instead of the columns, since the term g βXs is insensitive to the rows or the columns of X. Hamburg's DSE scheme [14] breaks this asymmetry by "compressing" g βXs using a random linear combination of the rows (that is, β is replaced by a random vector b); the ensuing construction has a structure similar to the HIBE scheme in [7] and we only know how to prove security under a stronger q-type assumption.…”

Generalization of the Selective-ID Security Model for HIBE Protocols

“…On the other hand, protocols such as [3,5] which are secure in the selective-ID model have no security degradation. Thus, one can work with significantly smaller size groups while implementing the protocols in [3,5] compared to the protocols in [4,18,12]. The protocols that are described in this paper have no security degradation.…”