SECURITY PROOF FOR SHENGBAO WANG S IDENTITY-BASED ENCRYPTION SCHEME

Transcription

1 SCURITY PROOF FOR SNGBAO WANG S IDNTITY-BASD NCRYPTION SCM Suder Lal ad Priyam Sharma Derpartmet of Mathematics, Dr. B.R.A.(Agra), Uiversity, Agra-800(UP), Idia. -mail- suder_lal@rediffmail.com, priyam_sharma.ibs@rediffmail.com Abstract: This paper aalyzes the security of a IB scheme proposed by Wag i 007. It is show that uder BDP (which is polyomially time euivalet to BIDP) assumptio the scheme is secure i radom oracle model. Key-Words: Public Key cryptio, Idetity-Based cryptio (IB), Oe-Way cryptio (OW), Oe-Way Idetity-Based cryptio (ID-OW).. Itroductio: I 984, Shamir [] itroduced the idea of idetity-based cryptosystem, i which the public key of a user is derived from his idetity. The idea is to elimiate the eed for directory ad certificates, which are used i traditioal public key cryptosystems where public keys are geerated by the users at radom. Sice 984, there have bee several proposals to realize idetity-based ecryptio (IB) schemes. owever, it was oly i 00, that Da Boeh ad Matt Frakli [] came up with first fully fuctioal solutio for IB. It was realized usig biliear pairigs over elliptic curves. Boeh ad Frakli also gave the security proofs for their scheme. The scheme relies o the BD problem for its security. Recetly, Shegbao Wag [3] has proposed aother IB scheme based o biliear pairig. This scheme is more practical i a multiple Private Key Geerator (PKG) eviromet. owever, the security aspect of this scheme is left ope [3]. I this paper, we aalyze the security of the IB scheme by Wag. We show that the security of the scheme is secure uder the BD assumptio i the radom oracle model. It may be oted that accordig to Zhag, Safavi-Naii ad Susilo [4] BDP is polyomially euivalet to BIDP.. Prelimiaries:. Idetity-Based cryptio (IB) Scheme: A idetity-based cryptio Scheme cosists of four radomized algorithms: Setup, xtract, crypt, ad Decrypt. Setup: It takes a security parameter k ad returs system parameters params ad master-key. The params which is kow publically icludes the descriptio of a fiite message space ad the descriptio of a fiite ciphertext space. The master-key is kow oly to the private key geerator (PKG).

2 xtract: This algorithm extracts private key from the give public key. It takes as iput params, the master-key ad a strig ID {0, } *, ad returs a private key d ID. ID which is a arbitrary strig will be used as public key, ad d ID as the correspodig private key. crypt: Takes as iput the params, ID ad M ad returs a ciphertext C Decrypt: Takes as iput params, a private key d ID, ad C. ad returs M. If params is the system parameters produced by the Setup algorithm, d ID is the private key, correspodig to ID, which is geerated by the algorithm xtract, the for M Decrypt (params, d ID, crypt (params, ID, M)) = M.. Oe-Way Idetity-Based cryptio: For a public-key ecryptio Oe-Way cryptio (OW) is defied by the followig game: The adversary is give a public-key K Pub, which is radom ad a ciphertext C, which is the ecryptio of a radom plaitext M usig K Pub. The goal of the adversary is to recover the correspodig plaitext M. A public key ecryptio scheme is said to be a OW scheme if o polyomially bouded adversary has a o-egligible advatage i attackig the scheme. This defiitio of OW may be stregtheed to ID-OW allowig the adversary to obtai some of the private keys. Thus, Oe-Way Idetity-Based cryptio (ID-OW) is defied through the followig game: Setup: The challeger takes a security parameter k ad rus the Setup algorithm. She the returs public system parameters params to the adversary ad keeps the master-key to itself. Phase: The adversary issues private-key extractio ueries ID, ID,..., ID. The challeger respods by ruig the algorithm extract to geerate the private-key d i correspodig to the public-key ID i ad returs to the adversary. Challege: The adversary outputs a public-key ID, differet from ID, ID,., ID, o which she wishes to be challeged. The challeger picks a radom plaitext M ad ecrypts it usig the public-key ID ad seds the resultig ciphertext to the adversary. Phase: The adversary issues more private-key extractio ueries ID +, ID +,., ID t differet from ID. The challeger respods as i Phase. Guess: The adversary outputs a guess M ad wis if M = M.

3 Such a adversary is referred as ID-OW adversary ad the advatage of such a adversary agaist the scheme is defie to be Pr [M = M] where the probability is over the radom choices made by the adversary ad the challeger. A IB scheme is a ID- OW scheme if o polyomially bouded adversary has o-egligible advatage agaist the challeger i the game described above..3 Biliear Pairigs: Let G be a additive group of order p, a prime ad let P be a geerator of G. Let G be a multiplicative group of the same order p. A map e : G G G is said to be a biliear pairig if it satisfies the followig properties: (Biliearity): For all P, Q G ad a, b Z p *, e ) ab ( ap, bp) e( P, P. (No-Degeeracy): For a give R G, e ( Q, R), for all Q G if ad oly if R 0, where is the idetity of G ad 0 is the idetity of G. (Computability): For all P, Q e( P, Q) i polyomial time. G, the there is a efficiet algorithm to compute Some mathematical problems i G, G are described as follows: Computatioal Diffie-ellma Problem (CDP): Give P, ap, bp i G, for some (ukow) a, b Z p *, compute abp i G. Biliear Diffe-ellma Problem (BDP): Give P, ap, bp, cp i G, for some (ukow) a, b Z * abc p compute e ( P, P) i G. Biliear Iverse Diffie-ellma Problem (BIDP): Give P, ap, bp i G, for some (ukow) a, b, c Z p *, compute e a b ( P, P) i G. Biliear Suare Diffie-ellma Problem (BSDP): Give P, ap, bp i G for some (ukow) a, b Z p *, compute e a b ( P, P) i G. It is easy to show that, if we have a algorithm to solve the CDP i G or G, the we ca use this algorithm to solve BDP i <G, G, e>. I other words, the BDP i <G, G, e> is o harder tha the CDP i G or G. But, the problem that the CDP i G or G is o harder tha the BDP is still a ope problem. Also, it is show i [4] that BDP, BIDP, ad BSDP are all polyomial time euivalet.

4 .4 IB Scheme by Wag: We first ow describe the IB scheme proposed by Wag [3]. The scheme cosists of the followig four algorithms: Setup: The algorithm works as follows:. Ru o iput k to geerate two prime order groups G ad G ad a biliear map e : G G G. ere G = G =p ad G = < P >. Choose s Z p * ad computes P Pub = s - P G *. 3. For a suitable N, choses the message space ={0,}, the ciphertext space = G * x {0,} ad two cryptographic hash fuctios : {0,} * G ad : G {0, }. The params is <G, G, e,, p, P, P Pub,, >, ad the master-key is s. xtract: For a idetity ID {0,}, PKG computes. Q ID = (ID) G * as public key, ad. d ID = sq ID as private key. crypt: To ecrypt message m for user with idetity ID the seder. picks a radom r Z p *. computes Q ID = (ID) ad g ID = e (P, Q ID ) G, ad 3. sets the ciphertext C=< rp Pub, m (g ID r ) >. Decrypt: To decrypt a ciphertext C=<U, V>, the receiver usig the private key d ID, ad params < G, G, e,, p, P, P Pub, Q ID, >. computes m = V (e (U, d ID) ), ad. returs m. The correctess follows from e ( U, d ) e( rs P, sq ) e( P, Q ) ID ID ID r Security Aalysis: We ow show that the IB scheme of Wag above is a Oe-Way Idetity-Based cryptio Scheme (ID-OW) assumig that the BIDP is hard. We prove the followig theorem:

5 Theorem: Let, be radom oracles. Suppose there is a ID-OW attacker that has advatage agaist the IB scheme of Wag which makes atmost 0private key extractio ueries to ad 0 hash ueries to. The there is a algorithm that solves BDP i with advatage at least e ). (. where e.7 is the base of atural logarithm. The ruig time of algorithm is O (time ( )). To prove the above theorem we make use of the followig public-key ecryptio scheme called as BasicPub-Wag: 3.BasicPub: The scheme has three algorithms: Keyge, crypt, ad Decrypt. Algorithms crypt ad Decrypt are same as that of IB scheme of Wag. The scheme is as follows: Keyge: The algorithm works as follows:. As i the Setup algorithm of IB scheme of Wag, geerates two prime order groups G, G ad a biliear map e : G G G. Also, the PKG computes its public key P Pub ad secret key s i the same way.. The message space = {0,}, the ciphertext space = G * x {0,} ad a cryptographic hash fuctio : G {0, } are chose i the same way. 3. The algorithm ow picks a radom poit Q ID i G *, the group geerated by P. 4. The public key is <G, G, e,, p, P, P Pub, Q ID, >, the private key is d ID =sq ID G *. crypt: To ecrypt m {0, }, the algorithm choses radom r Z p * ad computes C=< rp Pub, m (g ID r ) >, where g ID = e (P, Q ID ) G * Decrypt: To decrypt C=<U, V> the algorithm takes < G, G, e,, p, P, P Pub, Q ID, > ad private key d ID as iput,. computes m = V (e (U, d ID )), ad. returs m.

6 To prove the theorem, we proceed i three steps. I the first step we show that ID-OW attack o Wag s scheme ca be coverted ito OW attack o BasicPub-Wag. This will show that private key extractio ueries do ot help the adversary. I the secod step we show that OW attack o BasicPub-Wag ca be coverted ito a algorithm to solve BID Problem. I the third step we use the result that the BIDP is pollyomially time euivalet to BDP [4]. Therefore, OW attack o BasicPub-Wag ca be coverted ito a algorithm to solve BDP. Theorem.: Let be a radom oracle from {0, } * to G *. Let be a adversary that has advatage agaist the IB scheme of Wag. Suppose makes atmost 0 private key extractio ueries. The there is a OW adversary agaist BasicPub-Wag havig advatage at least. The ruig time of is O (time ( )). e( ) Proof: The game starts with the challeger who geerates a radom public key by ruig algorithm keyge of BasicPub-Wag. The result is a public key by K Pub = <G, G, e,, p, P, P Pub, Q ID, > ad a private key d ID = sq ID. Let G =p= G. The challeger picks a radom M { 0,} ad ecrypts it usig algorithm ecrypt of BasicPub-Wag. It gives K pub ad the resultig ciphertext C=<U, V> to adversary. Setup: gives algorithm the system parameters of the IB scheme of Wag <G, G,e,, p, P, P Pub,Q ID,, > where G, G,e,, p, P, P Pub,Q ID, are take from K Pub, ad is a radom oracle cotrolled by. -ueries: At ay time algorithm ca uery the radom oracle.to respod to these ueries algorithm maitais a list say -list of tuples < ID j, Q j, b j, coi j > as explaied below : Whe algorithm A ueries the oracle at a poit ID j algorithm respods as follows: If the uery ID j already appears o the -list i a tuple < ID j, Q j, b j, coi j > the algorithm respods with ( ID i ) = Q i G Otherwise, geerates a radom bit coi {0,} so that Pr [ coi=0 ] = for some. Algorithm picks a radom 0 b Z p *. If coi = 0 it computes Q i = b P Pub G *, ad if coi = it computes Q i = b Q ID G *. Algorithm adds the tuple < ID i, Q i, b i, coi i > to the -list ad respods to with ( ID i ) = Q i I both the cases, the distributio Q i of is uiform i G * ad idepedet of s view.

7 Phase : Algorithm issues private key extractio ueries. Algorithm respods to these ueries as follows: * Rus the above algorithm for respodig to -ueries to obtai a Q i G such that (ID i ) = Q i. Let < ID i, Q i, b i, coi i > be the correspodig tuple o the -list. If coi i =, the reports failure ad termiates. The attack o the BasicPub-Wag fails. If coi i = 0, the Q i = b i P Pub. Defie d i = b i P. (d i = sq i = s b i P Pub = s b i s P = b i s s - P = b i P) Challege: Oce algorithm decides that Phase is over, it outputs a public key ID {0, } * o which it wishes to be challeged. respods as follows:. Ru the above algorithm for respodig to -ueries to obtai Q G * such that (ID) = Q. Let < ID, Q, b, coi > be the correspodig tuple o the -list. If coi = 0, the reports failure ad termiates. The attack o BasicPub-Wag failed.. We kow, if coi =, Q = bq ID. 3. C=< U, V > is the challeged ciphertext give to algorithm. Algorithm sets C = < b - U, V > where b - is the iverse of b mod p. Algorithm respods to algorithm with the challege C. C is a ecryptio of M usig Wag s scheme uder the public key ID as reuired. Sice (ID) = Q. The correspodig private key is d ID = sq Also, e( b - U, d ID ) = e( b - U, sq) = e(u, b - sq) = e(u, b - sbq ID ) = e(u, sq ID ) = e( U, d ID ). ece, the decryptio of C, usig Wag s scheme, usig d ID BasicPub-Wag ecryptio of C usig d ID. is the same as the Phase : Algorithm respods to private key extractio uery i the same way as it did i Phase. Guess: vetually, algorithm will produce a guess M. Algorithm outputs M as its guess for the decryptio of C. Claim: If algorithm does ot abort durig the simulatio, the algorithm s view is idetical to its view i the real attack. Ad, if algorithm does ot abort, the

8 Pr [M=M ], where probability is over the radom bits use by algorithms ad the challeger. Proof: If algorithm does ot abort, the all resposes give by the -oracle are uiformly a idepedetly distributed i G *, all resposes to the private key extractio ueries are valid ad the challeged ciphertext C is the ecryptio of a radom plaitext M M. Thus, algorithm s view is idetical to its view i the real attack. The challege ciphertext C give to algorithm is the ecryptio of M usig Wag s uder the public idetity ID chose by algorithm. ece, by defiitio of algorithm correct guess with probability at least., it will make the Now we shall compute the probability that algorithm does ot abort durig the simulatio. If algorithm makes at most private key extractio ueries, the the probability does ot abort while treatig oe of those ueries is. The probability that algorithm does ot abort durig the simulatio is.therefore, the probability that algorithm B does ot abort durig the simulatio is ( ).The value of is chose to be as we wat to maximize this fuctio. The probability that algorithm does ot abort is at least. e( ) Note that, probability that algorithm does ot abort is ( ) ( ) [ ] [ ] [ ] ( ) also, Lim 0 ( ) ] [ e Theorem.: Let be a radom oracle from G to {0, }. Let algorithm be a OW adversary that has advatage agaist BasicPub-Wag. Suppose algorithm makes a total 0 ueries to. The there is a algorithm that ca solve BIDP i with advatage at least ( ) ad ruig time O (time )). Proof: Algorithm is give a iput the BID parameters <G, G, e > produced by ad a radom istace <P, ap, bp> of the BID problem for these parameters i.e., e( P, P) G * P R G where a, b R Z * a b p. G = p = G. Let be the solutio to this problem. Algorithm fids D by iteractig with algorithm A as follows: D

9 Challege: Algorithm creates the BasicPub public key K Pub = < G, G, e,, P, P Pub, Q ID, > by settig P Pub = ap, Q ID = bp. Algorithm the picks a radom strig R {0, } ad defies C to be the ciphertext, C = <U, V> where U = P ad V = R. Algorithm gives K Pub ad C as the challege to algorithm. Observe that, the private key associated to K Pub is d ID = a - Q ID = a - bp. Also, the decryptio of C is V (e (u, d ID )) = V (e (P, a - a b bp)) = V (e(p, P) ) = V (D) We set M = V (D). -ueries: At ay time algorithm may issue ueries to. To respod to these ueries algorithm maitais a list of pairs called the -list. ach etry i the list is a pair of the form < X j, j >. Iitially the list is empty. To respod to uery X j algorithm does the followig:. If the uery X j already appears o the -list, the he respods with (X j ) = j.. Otherwise, algorithm just picks a radom strig j {0, } ad adds the tuple <X j, j > to the list. It respods to algorithm with (X j ) = j. Guess: Algorithm outputs its guess M to the decryptio of C. At this poit algorithm picks a radom pair <X j, j > from the -list ad outputs X j as the solutio to the give istace of BIDP. Agai, it is easy to see that s view is idetical to its view i the real attack. The setup is as i the real attack. Sice a ad b are radom i Z * p so is the challege. * Sice, P is a radom i G ad therefore, the resultig ecryptio message is a radom plaitext. Sice it is exclusive-or of two radom strigs i {0,}. Thus Pr M ' M. It still remais to calculate the probability that algorithm outputs the correct result. Let deote the evet that at the ed of the simulatio D appears i a pair o - lists. Let Pr. If D does ot appear i -lists, the the decryptio of C is idepedet of s view, sice (D) is a radom strisg i {0,} idepedet of s view. Thus, Pr M' M Therefore, Pr M ' M Pr M ' M.Pr Pr M ' M.Pr Pr Pr M ' M.Pr ( )

10 Pr Also, sice we pick a radom elemet from -list, the probability that algorithm produces the right aswer is at least ( ) Pr Note that, if algorithm aswers correctly, the V M = (D). So algorithm could sca through the -list, ad pick a radom pair <X j, j > such that j = (D), ad output X j istead of pickig a radom pair i all the -list. Suppose that is very large, so that / represets a ifeasible umber of computatios. The, if we kew that wheever algorithm makes less that / -ueries, the probability that more tha k of these ueries result i the same hash value is a egligible fuctio f (D), the the probability that algorithm produces the right aswer is at least f ( D) k I Theorem of [3], Zhag, Safavi-Naii ad Susilo have show that BDP, BIDP ad BSDP are all polyomial time euivalet. Usig this result we ifer, that the scheme proposed by Wag is secure so log as the BDP is difficult. Therefore, we get the followig theorem, Theorem.3: Let be a radom oracle from G to {0, }. Let algorithm be a OW adversary that has advatage agaist BasicPub-Wag. Suppose algorithm makes a total 0 ueries to. The there is a algorithm that ca solve BD problem i with advatage at least ad ruig time O (time ( )). Proof of the Theorem: Directly from the results from Theorem., Theorem. ad Theorem.3, we get that, if there exists a ID-OW adversary agaist algorithm that has advatage agaist IB scheme of Wag, the there is a algorithm that ca solve BDP for with advatage at least. e e.. as reuired.

11 4. Summary: I this paper we give the security proofs for the IB scheme proposed by Wag, which is more practical i multiple PKG eviromets tha the famous IB scheme proposed by Boeh ad Frakli. Refereces: ) D.Boeh ad M.Frakli, Idetity-based ecryptio from weil pairig, I Proc. Of CRYPTO 00, LNCS # 39, pp.3-9. Spriger-Verlag, 00. ) A.Shamir, Idetity-based cryptosystems ad sigature schemes, I Proc. Of CRYPTO 984, LNCS # 96, pp Spriger-Verlag, 984. Also available o 3) S.Wag, Practical Idetity-Based cryptio (IB) i Multiple PKG viromets ad Its Applicatios, 4) F.Zhag, R.Safavi-Naii, ad W.Susilo, A efficiet sigature scheme from biliear pairigs ad its applicatios, I Iteratioal Workshop o Practice ad Theory i Public Key Cryptography-PKC 004. LNCS # 947, pp.77-90, Spriger-Verlag, 004.

12 This documet was created with WiPDF available at The uregistered versio of WiPDF is for evaluatio or o-commercial use oly.