基于身份加密的密码学：Weil配对与椭圆曲线

需积分: 9 31 浏览量更新于2024-07-17 收藏 281KB PDF 举报

"这篇PDF文件是关于身份基加密(Identity-Based Encryption, IBE)的研究论文，由DAN BONEH和MATTHEW FRANKLIN在2003年发表于SIAM J.COMPUT.该文介绍了如何利用椭圆曲线上的Weil配对构建一个全功能的身份基加密方案，并在随机预言机模型下假设计算 Diffie-Hellman问题的一个变种来保证选择密文安全性。此外，文中还给出了IBE方案的安全性精确定义以及多种应用示例。关键词涉及身份基加密、双线性映射、Weil配对、Tate配对、椭圆曲线密码学和Escrow ElGamal。" 身份基加密(IBE)是一种公钥加密体制，它的主要特点是公钥可以是任意字符串，这与传统的公钥加密系统中每个用户都有一个特定的公钥不同。在IBE系统中，有四个主要算法：(1) 设置算法生成全局系统参数和主密钥；(2) 提取算法使用主密钥根据任意字符串生成对应的私钥；(3) 加密算法允许任何人使用接收者的公开身份来加密消息；(4) 解密算法仅需对应私钥才能解密。 Weil配对是一种双线性映射，它是椭圆曲线密码学中的关键工具。双线性映射是在两个群之间定义的一种映射，保持乘法结构的性质，即对于群中的元素，映射具有线性和配对性的特性。在IBE中，Weil配对特别有用，因为它可以用来构造安全的加密方案，尤其是在处理公钥和私钥的关联时。该文提出的IBE方案在随机预言机模型下提供选择密文安全性，这是密码学中衡量加密安全性的重要标准。假设的计算 Diffie-Hellman问题变种是证明其安全性的重要基础。随机预言机模型是一种理论工具，用于分析加密算法在理想化随机函数（而非实际的哈希函数）下的安全性。此外，文中还探讨了Tate配对，这是与Weil配对相关的另一种椭圆曲线上的双线性映射，它们在某些情况下可以互换使用。同时，文中提到了Escrow ElGamal，这是一种特殊的ElGamal加密变体，通常用于解决密钥管理问题，尤其是当用户丢失私钥时，可以通过保管密钥的第三方来恢复。最后，文中列举了身份基加密的多个应用场景，可能包括但不限于：在大规模分布式系统中简化密钥管理、实现匿名通信、以及支持灵活的访问控制策略等。这些应用体现了IBE在实际密码学系统设计中的广泛潜力和重要性。

IDENTITY-BASED ENCRYPTION 591

two equal-length messages M

and M

and receives the encryption of M

from the

challenger, where b is chosen at random in {0, 1}; (3) the adversary outputs b



and

wins the game if b = b



. The public key system is said to be semantically secure if

no polynomial time adversary can win the game with a nonnegligible advantage. As

shorthand, we say that a semantically secure public key system is IND-CPA secure.

Semantic security captures our intuition that, given a ciphertext, the adversary learns

nothing about the corresponding plaintext.

To deﬁne semantic security for identity-based systems (denoted IND-ID-CPA), we

strengthen the standard deﬁnition by allowing the adversary to issue chosen private

key extraction queries. Similarly, the adversary is challenged on a public key ID

of her choice. We deﬁne semantic security for IBE schemes using an IND-ID-CPA

game. The game is identical to the IND-ID-CCA game deﬁned above except that the

adversary cannot make any decryption queries. The adversary can only make private

key extraction queries. We say that an IBE scheme E is semantically secure (IND-ID-

CPA) if no polynomially bounded adversary A has a nonnegligible advantage against

the challenger in the following IND-ID-CPA game.

Setup. The challenger takes a security parameter k and runs the Setup algo-

rithm. It gives the adversary the resulting system parameters params.It

keeps the master-key to itself.

Phase 1. The adversary issues private key extraction queries ID

,... ,ID

. The

challenger responds by running algorithm Extract to generate the private key

corresponding to the public key ID

. It sends d

to the adversary. These

queries may be asked adaptively.

Challenge. Once the adversary decides that Phase 1 is over, it outputs two

equal-length plaintexts M

∈Mand a public key ID on which it wishes

to be challenged. The only constraint is that ID did not appear in any private

key extraction query in Phase 1. The challenger picks a random bit b ∈{0, 1}

and sets C = Encrypt(params, ID,M

). It sends C as the challenge to the

adversary.

Phase 2. The adversary issues more extraction queries ID

m+1

,... ,ID

. The

only constraint is that ID

= ID. The challenger responds as in Phase 1.

Guess. Finally, the adversary outputs a guess b



∈{0, 1}. The adversary wins

the game if b = b



We refer to such an adversary A as an IND-ID-CPA adversary. As in the above, the

advantage of an IND-ID-CPA adversary A against the scheme E is the following

function of the security parameter k: Adv

E,A

(k)=



Pr[b = b



] −



The probability is over the random bits used by the challenger and the adversary.

Definition 2.2. We say that the IBE system E is semantically secure if for any

polynomial time IND-ID-CPA adversary A the function Adv

E,A

(k) is negligible. As

shorthand, we say that E is IND-ID-CPA secure.

One-way IBE. One can deﬁne an even weaker notion of security called one-way

encryption (OWE) [16]. Roughly speaking, a public key encryption scheme is a one-

way encryption if, given the encryption of a random plaintext, the adversary cannot

produce the plaintext in its entirety. One-way encryption is a weak notion of security

since there is nothing preventing the adversary from, say, learning half the bits of

the plaintext. Hence one-way encryption schemes do not generally provide secure

encryption. In the random oracle model, one-way encryption schemes can be used for

encrypting session-keys. (The session-key is taken to be the hash of the plaintext.) We

note that one can extend the notion of one-way encryption to identity-based systems

Downloaded 05/31/19 to 59.64.129.221. Redistribution subject to SIAM license or copyright; see http://www.siam.org/journals/ojsa.php

剩余29页未读，继续阅读

知识滴海洋

粉丝: 2
资源: 9

基于身份加密的密码学：Weil配对与椭圆曲线

IEEE会议论文LaTeX参考文献编辑指南

岩石力学研究论文集：系统设计方案与DOS应用

Android Socket聊天功能实现与源码参考

《南京工程学院学报》参考文献著录格式[参考].pdf

用EndNote在WORD自动插入参考文献的方法 (2).pdf

参考文献写法参考.pdf

本科毕业论文开题报告参考文献目录格式.doc.pdf

参考文献类型及其标志.pdf

参考文献引用规范要求.pdf

参考文献与常用网站.pdf

最新资源