基于Weil配对的IBE身份加密算法详解

5星 · 超过95%的资源需积分: 42 116 浏览量更新于2024-08-02 3 收藏 286KB PDF 举报

"IBE基于身份的加密经典算法" 本文主要探讨了Identity-Based Encryption（IBE）的理论与应用，这是一种基于身份的加密技术，由Dan Boneh和Matthew Franklin在2003年的SIAM Journal of Computing上发表。IBE允许使用任意字符串（如电子邮件地址或用户名）作为公钥，简化了传统公钥加密体系中的密钥分发问题。论文提出了一种完全功能的IBE方案，该方案在随机预言模型下具有选择明文安全性，假设了一个计算Diffie-Hellman问题的变种。该系统是基于双线性映射在群之间的概念构建的，特别是椭圆曲线上的Weil配对是一个典型例子。Weil配对是一种双线性映射，可以在特定类型的数学结构上高效地操作，为加密提供了一种强大的工具。文中给出了IBE的安全性定义，并详述了如何构建这种加密系统。首先，"setup"算法生成全局系统参数和一个主密钥；"extract"算法利用主密钥为任何给定的公开身份ID生成对应的私钥；"encrypt"算法允许发送者使用接收者的身份ID加密消息；最后，"decrypt"算法允许拥有对应私钥的接收者解密这些被加密的消息。 IBE的主要优点在于其灵活性和可扩展性。它消除了公钥基础设施（PKI）中管理公钥证书的复杂性，因为不再需要权威机构来验证和分发公钥。此外，由于密钥与用户身份直接相关，IBE也适用于动态环境，例如，当新的用户加入或离开时，密钥管理变得更加简单。作者还探讨了IBE在实际应用中的多种可能性，包括但不限于数据保密、访问控制和匿名通信。例如，IBE可以用于安全电子邮件系统，使得只有指定收件人的私钥才能解密邮件。同时，IBE还可以用于实现安全的云存储，用户的数据可以使用他们的身份进行加密，只有拥有正确私钥的用户才能访问自己的数据。 IBE是一种创新的加密方法，它简化了密钥管理和提高了系统的可扩展性。然而，它依赖于数学难题的复杂性，例如计算Diffie-Hellman问题的变种，这在理论上为攻击者提供了潜在的破解途径。因此，对IBE的安全性和效率的研究仍然是密码学领域的重要课题。随着计算能力的提升，不断探索更安全、更高效的IBE方案对于保护信息安全至关重要。

To deﬁne semantic security for identity based systems (denoted IND-ID-CPA) we strengthen the

standard deﬁnition by allowing the adversary to issue chosen private key extraction queries. Similarly,

the adversary is challenged on a public key ID of her choice. We deﬁne semantic security for identity

based encryption schemes using an IND-ID-CPA game. The game is identical to the IND-ID-CCA game

deﬁned above except that the adversary cannot make any decryption queries. The adversary can only

make private key extraction queries. We say that an identity-based encryption scheme E is semantically

secure (IND-ID-CPA) if no polynomially bounded adversary A has a non-negligible advantage against

the Challenger in the following IND-ID-CPA game:

Setup: The challenger takes a security parameter k and runs the Setup algorithm. It gives

the adversary the resulting system parameters params. It keeps the master-key to itself.

Phase 1: The adversary issues private key extraction queries ID

, . . . , ID

. The challenger

responds by running algorithm Extract to generate the private key d

corresponding to

the public key ID

. It sends d

to the adversary. These queries may be asked adaptively.

Challenge: Once the adversary decides that Phase 1 is over it outputs two equal length

plaintexts M

, M

∈ M and a public key ID on which it wishes to be challenged. The

only constraint is that ID did not appear in any private key extraction query in Phase 1.

The challenger picks a random bit b ∈ {0, 1} and sets C = Encrypt(params, ID, M

). It

sends C as the challenge to the adversary.

Phase 2: The adversary issues more extraction queries ID

m+1

, . . . , ID

. The only constraint

is that ID

6= ID. The challenger responds as in Phase 1.

Guess: Finally, the adversary outputs a guess b

∈ {0, 1} and wins the game if b = b

We refer to such an adversary A as an IND-ID-CPA adversary. As we did above, the

advantage of an IND-ID-CPA adversary A against the scheme E is the following function of

the security parameter k: Adv

E,A

(k) =



Pr[b = b

] −



The probability is over the random bits used by the challenger and the adversary.

Deﬁnition 2.2. We say that the IBE system E is semantically secure if for any polynomial time IND-

ID-CPA adversary A the function Adv

E,A

(k) is negligible. As shorthand, we say that E is IND-ID-CPA

secure.

One way identity-based encryption. One can deﬁne an even weaker notion of security called one-

way encryption (OWE) [16]. Roughly speaking, a public key encryption scheme is a one-way encryption

if given the encryption of a random plaintext the adversary cannot produce the plaintext in its entirety.

One way encryption is a weak notion of security since there is nothing preventing the adversary from,

say, learning half the bits of the plaintext. Hence, one-way encryption schemes do not generally provide

secure encryption. In the random oracle model one-way encryption schemes can be used for encrypting

session-keys (the session-key is taken to be the hash of the plaintext). We note that one can extend

the notion of one-way encryption to identity based systems by adding private key extraction queries to

the deﬁnition. We do not give the full deﬁnition here since in this paper we use semantic security as

the weakest notion of security. See [5] for the full deﬁnition of identity based one-way encryption, and

its use as part of an alternative proof strategy for our main result.

Random oracle model. To analyze the security of certain natural cryptographic constructions Bel-

lare and Rogaway introduced an idealized security model called the random oracle model [3]. Roughly

speaking, a random oracle is a function H : X → Y chosen uniformly at random from the set of all

functions {h : X → Y } (we assume Y is a ﬁnite set). An algorithm can query the random oracle at

any point x ∈ X and receive the value H(x) in response. Random oracles are used to model crypto-

graphic hash functions such as SHA-1. Note that security in the random oracle model does not imply

security in the real world. Nevertheless, the random oracle model is a useful tool for validating natural

cryptographic constructions. Security proofs in this model prove security against attackers that are

conﬁned to the random oracle world.

Notation. From here on we use Z

to denote the group {0, . . . , q − 1} under addition modulo q. For

a group G of prime order we use G

∗

to denote the set G

∗

= G \ {O} where O is the identity element

in the group G. We use Z

to denote the set of positive integers.

3 Bilinear maps and the Bilinear Diﬃe-Hellman Assumption

Let G

and G

be two groups of order q for some large prime q. Our IBE system makes use of a bilinear

map ˆe : G

× G

→ G

between these two groups. The map must satisfy the following properties:

1. Bilinear: We say that a map ˆe : G

× G

→ G

is bilinear if ˆe(aP, bQ) = ˆe(P, Q)

for all P, Q ∈ G

and all a, b ∈ Z.

2. Non-degenerate: The map does not send all pairs in G

× G

to the identity in G

. Observe that

since G

, G

are groups of prime order this implies that if P is a generator of G

then ˆe(P, P ) is a

generator of G

3. Computable: There is an eﬃcient algorithm to compute ˆe(P, Q) for any P, Q ∈ G

A bilinear map satisfying the three properties above is said to be an admissible bilinear map. In

Section 5 we give a concrete example of groups G

, G

and an admissible bilinear map between them.

The group G

is a subgroup of the additive group of points of an elliptic curve E/F

. The group G

is a

subgroup of the multiplicative group of a ﬁnite ﬁeld F

∗

. Therefore, throughout the paper we view G

as an additive group and G

as a multiplicative group. As we will see in Section 5.1, the Weil pairing

can be used to construct an admissible bilinear map between these two groups.

The existence of the bilinear map ˆe : G

× G

→ G

as above has two direct implications to these

groups.

The MOV reduction: Menezes, Okamoto, and Vanstone [32] show that the discrete log problem in

is no harder than the discrete log problem in G

. To see this, let P, Q ∈ G

be an instance

of the discrete log problem in G

where both P, Q have order q. We wish to ﬁnd an α ∈ Z

such

that Q = αP . Let g = ˆe(P, P ) and h = ˆe(Q, P ). Then, by bilinearity of ˆe we know that h = g

By non-degeneracy of ˆe both g, h have order q in G

. Hence, we reduced the discrete log problem

in G

to a discrete log problem in G

. It follows that for discrete log to be hard in G

we must

choose our security parameter so that discrete log is hard in G

(see Section 5).

Decision Diﬃe-Hellman is Easy: The Decision Diﬃe-Hellman problem (DDH) [4] in G

is to dis-

tinguish between the distributions hP, aP, bP, abP i and hP, aP, bP, cP i where a, b, c are random

in Z

∗

and P is random in G

∗

. Joux and Nguyen [28] point out that DDH in G

is easy. To see

this, observe that given P, aP, bP, cP ∈ G

∗

we have

c = ab mod q ⇐⇒ ˆe(P, cP ) = ˆe(aP, bP ).

剩余30页未读，继续阅读

zealot906

粉丝: 0
资源: 1

基于Weil配对的IBE身份加密算法详解

基于身份的加密方案（IBE）

基于身份加密算法相关论文

基于IBE的PKG程序设计（Java）

在基于身份加密(IBE)中，Weil配对和Tate配对是如何保障选择密文安全性的？请结合随机oracle模型解释其安全性的保证原理。

在实现基于Weil配对的身份加密（IBE）时，如何确保系统在随机oracle模型下的选择明文攻击（CPA）安全性？

CP-ABE与IBE的区别

PKI\IBE\CPK优缺点

python写一个完整的分级身份签名算法

BETHENCOURT J, SAHAI A, WATERS B. Ciphertext-policy attribute-based encryption[C]

中航信ibe接口接入

最新资源