Tools for Simulating Features of Composite Order Bilinear Groups in the Prime Order Setting

Abstract

In this paper, we explore a general methodology for converting composite order pairingbased cryptosystems into the prime order setting. We employ the dual pairing vector space approach initiated by Okamoto and Takashima and formulate versatile tools in this framework that can be used to translate composite order schemes for which the prior techniques of Freeman were insufficient. Our techniques are typically applicable for composite order schemes relying on the canceling property and proven secure from variants of the subgroup decision assumption, and will result in prime order schemes that are proven secure from the decisional linear assumption. As an instructive example, we obtain a translation of the Lewko-Waters composite order IBE scheme. This provides a close analog of the BonehBoyen IBE scheme that is proven fully secure from the decisional linear assumption. We also provide a translation of the Lewko-Waters unbounded HIBE scheme.

Improving the Message-Ciphertext Rate of Lewko’s Fully Secure IBE Scheme

“…As in [10], we use dual pairing vector space to achieve the canceling and parameter hiding properties in the prime order setting.…”

“…In 2010, Freeman [8] provided a generic method for transforming schemes in composite order settings [4,9,11] to prime order settings, but the method can not be applied to some schemes. Lewko [10] observed that the method of [8] perfectly simulated the "canceling" property, yet was not a useful approach to achieve the "parameter hiding" property. Lewko [10] used dual pairing vector space which was proposed by Okamoto and Takashima [13,14] to simulate both properties in the prime order setting, and got a fully secure IBE scheme akin to the one in [2].…”

“…Lewko [10] used dual pairing vector space which was proposed by Okamoto and Takashima [13,14] to simulate both properties in the prime order setting, and got a fully secure IBE scheme akin to the one in [2]. Specially, to achieve the canceling property, a pair of dual orthonormal bases (B, B * ) was used in [10]; to achieve the parameter hiding property, for a matrix A to be hidden, a pair of random dual orthonormal bases (B, B * ) was chosen, then A was embedded in (B, B * ), and a new pair of dual orthonormal bases (B A , B * A ) was generated, which looks random to the adversary who does not know (B, B * ). The scheme in [10] has simple structure and its security is based on the DLIN assumption.…”

“…In the IBE sheme in [10], both ciphertext and secret key employ two parameters, s 1 , s 2 and r 1 , r 2 . The two exponents play almost the same roles, except that in the ciphertext, the element hiding the message only uses s 1 .…”

“…In this paper, we improve the IBE scheme presented in [10] by using both parameters to hide messages in the ciphertext, hence get an IBE scheme that can encrypt two elements in the target group simultaneously. As in [10], we use dual orthonormal bases of dimension 6. Compared to Lewko's scheme, we only add one element from the target group to the public parameters and ciphertexts, double the length of the decryption key.…”