Pairing based IBE Some Definitions Some more definitions

Pairing based IBE

Some Definitions •

Some more definitions •

Tate Pairing •

Few Details •

Making the output unique •

Tate Pairing and Weil Pairing •

Linear Dependence Property •

Application of Pairings: Finally! • Two Party One-round Key agreement Protocol a. P Bob (b) Alice (a) • • • b. P P is a base point of an EC. Public Knowledge: (n, P). Alice selects aϵ[1, n-1] and sends a. P. Bob selects bϵ[1, n-1] and sends b. P. Both can compute ab. P. Eavesdropper is faced with the task of computing K given (P, a. P, b. P). This instance of problem is called DHP (Diffie-Hellman Problem).

Extending to Three Parties • Can be easily extended to 3 parties Alice (a) b. P a. P Round 1 Bob (b) c. P Chris (c)

Extending to Three Parties • Can be easily extended to 3 parties Alice (a) Bob (b) bc. P Round 2 ab. P ca. P Chris (c) • Key=abc. P. • Attackers’s Problem: Compute abc. P from (P, a. P, b. P, c. P, ab. P, bc. P, ca. P).

Can this be done in one round? • Problem remained open till 2000 when Joux devised a surprisingly simple protocol using bilinear pairings. • This triggered interest in Pairings, and two next most important applications emerged: • Boneh-Franklin IBE • Boneh, Lynn, Shacham short-signature scheme

Quick Refresh on Pairings •

Some more Derived Properties •

Implication on DLP • Discrete Log Problem (DLP): Let aϵ[0, n-1] be a secret, given a. P, compute a. • Believed to be intractable for a chosen group (like multiplicative group of a finite field, group of points on an EC defined over a finite field). • One consequence of the bilinearity property is that the DLP in G 1 can be efficiently reduced to the DLP in GT.

Implication on DLP • One consequence of the bilinearity property is that the DLP in G 1 can be efficiently reduced to the DLP in GT. • If (P, Q) is an instance of DLP in G 1 where Q=x. P, then e(P, Q)=e(P, x. P)=e(P, P)x. • Thus, log. PQ=logqh, where h=e(P, Q), and g=e(P, P) are elements of GT.

Bilinear Diffie-Hellman Problem (BDHP) • Let e be a bilinear pairing on (G 1, GT). The BDHP is the following: • Given P, a. P, b. P, compute e(P, P)abc • Hardness of BDHP => Hardness of DHP in both G 1 and GT. • If DHP in G 1 is not hard => BDHP is not hard. 1. ap, b. P => Compute ab. P 2. e(ab. P, c. P)=e(P, P)abc

Security Implications • If DHP in GT is not hard => BDHP is not hard. 1. 2. 3. 4. Compute g=e(P, P). Compute e(a. P, b. P)=gabϵGT Compute e(c. P, P)=gcϵGT Compute gabc from gab and gc.

Decisional Diffie-Hellman Problem due to Pairings •

Few Fundamental Protocols using Pairings • 3 -Party One Round Key Agreement: a. P Alice (a) b. P c. P a. P Round 1 Bob (b) Chris (c) Alice (and likewise the others) can compute: e(b. P, c. P)a=e(P, P)abc b. P

Short Signatures •

BLS Signatures • Alice’s private key, aϵ[1, n-1] • Public key: A=a. P. • Sign: • Alice’s Signature on a message mϵ{0, 1}* • M=H(m), s=a. M. • Verify: • Bob with the public key A=a. P can easily verify. • Bob calculates M=H(m) • Then Bob checks whether (P, A=a. P, M, s=a. M) is a valid quadruple by solving DDHP in G 1 (check e(P, s)=e(A, M))

Boneh Franklin’s IBE •

Private Key of Alice • Alice requests her private key d. A: • TTP creates Alice’s identity string IDA, computes d. A=t. H 1(IDA). • Securely transforms d. A to Alice. • Note that d. A is the BLS signature on the message IDA.

Bob’s Encryption for Alice •

Alice’s Decryption • Bob uses his decryption key d. A, and: • computes e(d. A, R)=e(t. H 1(IDA), r. P)=e(QA, t. P)r=e(QA, T)r • Thus Bob can recover m. • The eavesdropper has to compute e(QA, T)r from (P, QA, T, R)

CCA Security • Given a target ciphertext (R, c), flips the first bit of c to get c’, and then obtains m’ using the decryption oracle. • Then flips the first bit of m’ to get m.

CCA security •

Few More Security Implications • Bilinear DHP (BDHP): Given (P, a. P, b. P, c. P) • Decisional: c=ab? • Computational: Compute c. P=ab. P • Inverse DHP (IDHP): • Decisional: c=a-1 b? Equivalently, b=a-1? • Computational: c. P=a-1 b. P. Equivalently, b. P=a-1 P. • These hardness assumptions are the basis of most Pairing based protocols. • Now consider few attack oracles.

Attack Oracles • FAPI: Fixed Argument Pairing Inversion. • Consider a pairing: e: G 1 x. G 2 GT • FAPI-1 : O 1 • Input PϵG 1, zϵGT • Output QϵG 2, e(P, Q)=z. • FAPI-2: O 2 • Input QϵG 2, zϵGT • Output PϵG 1, st. e(P, Q)=z

Solve BCDHP • Bilinear DHP: Given (P, a. P, b. P, c. P) • Computational: Compute c. P=ab. P • z 1=e(a. P, Q) • a. Q=O 1(P, z 1) • z 2=e(b. P, a. Q) • ab. Q=O 1(P, z 2) • ab. P=O 2(Q, z 2)

Solve IDHP • Inverse DHP (IDHP): Given (P, a. P) • • • Computational: Compute b. P=a-1 P. Choose QϵG 2. z 1=e(a. P, Q) a. Q=O 1(P, z 1) z 2=e(P, Q) a-1 P=O 2(a. Q, z 2)