Whereas the protocol of BF-IBE includes steps for entity setup, encryption, key extraction, and decryption, PP-IBE introduces a sequence of identity and pseudonym credential steps into the workflow. To obtain the keying material used for decryption from the PKG, Alice must redeem a valid identity/pseudonym credential. Identity and pseudonym credentials are obtained through interaction with a community of Intermediate Certification Authorities (ICAs) who each verify Alice’s identity or the derivation of a pseudonym and issue a Brands digital credential. In the key extraction protocol, the PKG returns initial keying material which can be finalized (“un-blinded”) only by Alice using random data produced during pseudonym creation. The overall flow, from encryption, through pseudonymization, to key extraction, and finally to decryption, is shown in Figure 1.

Setup: First, as a precursor to protocol execution, all participants undergo a SETUP phase. The required public primitives and parameters for PP-IBE, BF-IBE, and DC are initialized into the environment.

Following the environment setup, each of the scenario participants is set up. Thus, individual participants (Alice and Bob) and the service providers (ICA_i,

ICA_j, ICA_k and PKG) are initialized, granted access to the environment, and instantiated with public keys, private keys, and attributes, as appropriate.

Encrypt: Bob encrypts a message for Alice as in BF-IBE. Given an identity string for Alice (say, alice@gmail.com) and only public functions and data, Bob encrypts a message for Alice and sends her the resulting ciphertext.

Get Identity/Pseudonym Credentials: To decrypt the message received from Bob, Alice requires a decryption key. This key is calculated by Alice using keying material provided by the PKG and using a set of random values which she chooses and stores during pseudonym creation (each random value is shared with only a single ICA). Figure 1 shows an identity credential being issued by ICA_i followed by consecutive steps with ICA_j and ICA_k in which pseudonym credentials are elaborated. Thus, each pseudonym is associated with a random data value; Alice creates and retains these values in local protected storage.

Extract: Alice presents a pseudonym credential to query the private key generator (PKG) which conducts a verification protocol. On successful verification, the PKG calculates keying material specific to messages encrypted for Alice. This keying material cannot be used directly to decrypt the ciphertext sent by Bob. Rather, Alice must finalize (“unblind”) the keying material into her decryption key by applying the random values accumulated during the pseudonym creation steps.

Decrypt: After finalization of her private key, Alice uses it to decrypt the ciphertext received from Bob. Decryption proceeds as specified in BF-IBE.

Elliptic Curves. An elliptic curve over a finite field E/F_p can be seen as the set of ( x , y ) points with x , y ∈ F p which satisfy an equation of the form E: y 2 + a 1 x y + a 3 y = x 3 + a 2 x 2 + a 4 x + a 6 , where x , y , a 1 , a 2 , a 3 , a 4 , a 6 ∈ F p .

The set of points in the curve E(F_p) includes a distinguished point, the point at infinity O , and forms a group under addition. The number of points on a curve #E(F_p) is called the order of the curve. The Hasse theorem places a bound on the number of points in a curve: # E ( F p ) = p + 1 − t , where | t | ≤ 2 p .

Background on supersingular elliptic curves can be found in [8] . Given a prime base b, an integer exponent e ³ 1, and t in a range, such that | t | ≤ 2 p , a supersingular curve E(F_p) over a field F on prime power p = b^e is a curve such that its order # E ( F p ) = p + 1 − t , with b | t [9] [10] . The worked example of §4, uses the curve E ( F 281 ) : y 2 = x 3 + 1 , which has order 282, with p = b = 281, e = 1 and t = 0. (To keep our example as simple as possible, we want to use a modulus that is a prime, rather than a prime power; thus, e = 1 and therefore p = b. Furthermore, supersingular curves of the form y 2 = x 3 + 1 over F_p are known to have order p + 1, meaning that t = 0. We chose p = 281 as this is a relatively small prime that is not too trivial such as 7 or 13.)

Each point on a curve also has an order, a scalar r, the number of times that point must be added to itself to give O : the order of a point o(P) = r, so that r ∗ P = O for P ∈ E ( F p ) . The r-torsion subgroup of a curve E(F_p)[r] is the subset of points in E(F_p) which have order r.

In this paper, curves are used in the context of bilinear maps (“pairings”). A taxonomy of pairing-friendly curves (including FMT curves, GMV curves, Freeman curves, Cyclotomic families, Sporadic families, Scott-Barreto families, Supersingular curves, Cocks-Pinch curves, MNT curves, and DEM curves) is presented in [11] .

The construction given in this paper uses a supersingular curve of the form y 2 = x 3 + 1 over F(p), with prime p ≡ 2 ( mod 3 ) . This follows the construction in BF-IBE and lends itself well to the requirements of PP-IBE where a point p₁ must be paired with itself. Other curves are also possible, including other supersingular curves and MNT curves.

Bilinear Maps. A bilinear map is a function e ^ : G 0 × G 1 → G T where G₀, G₁ and G_T have order q. We focus on so-called symmetric pairings, where G₀ = G₁. The mapping is bilinear if ∀ P 1 , P 2 ∈ G 1 and ∀ a , b ∈ Z q * , e ^ ( P 1 a , P 2 b ) = e ^ ( P 1 , P 2 ) a b , and it is non-degenerate if ∀ non-trivial points P 1 ∈ G 1 , e ^ ( P 1 , P 1 ) ≠ 1 (the multiplicative identity element in G_T). Two common pairing functions are the Weil pairing and the Tate pairing [8] [12] [13] . The worked example in this document was verified with both the Weil and Tate pairings but, for the sake of brevity, only the computations demonstrating the Weil pairing are shown in this paper.

The embedding degree of elliptic curve E(F_p) with respect to the order q of its q-torsion subgroup is the smallest positive integer k such that p k ≡ 1 ( mod q ) (for background, see [8] ). The embedding degree affects security. Curves with a small embedding degree are susceptible to the MOV reduction proposed by Menezes, Vanstone and Okamoto [9] . The MOV reduction allows the discrete log problem to be translated from the elliptic curve setting of G₁ to the finite field setting of G_T, in which there are faster sub-exponential algorithms to solve it [9] . For this reason, sufficiently large security parameters must be selected when instantiating our construction of PP-IBE (see §3, §5).

Distortion Maps. As we shall see, in its derivation of ξ, PP-IBE requires that the two inputs to the pairing be from the same cyclic group G₁. The Weil pairing produces the degenerate result 1 when the inputs P and Q are linearly dependent. The Tate pairing also has this property when k > 1. One technique for working around this issue is to use a supersingular curve, E, with a distortion map φ. The distortion map projects points from the base curve onto the curve on the extension field, in a manner that the points are no longer linearly dependent, and so the result of the Weil pairing is non-degenerate [3] [9] [12] . When distortion map functionality is required, supersingular curves are not the only choice. MNT curves and their trace map may also be used [14] . We selected the supersingular curve for pedagogical reasons, as a natural progression from BF-IBE and PP-IBE.

In 2001, Boneh and Franklin published the first Identity-based Encryption scheme [3] . Their scheme is defined in terms of bilinear maps. BF-IBE features four protocols.

Setup: The environment is initialized with public parameters q prime, groups G₁ and G_T of order q, bilinear map e ^ : G 1 × G 1 → G T , generator G ∈ G 1 , and hash functions H 1 : { 0 , 1 } * → G 1 * , where G 1 * = G 1 \ { O } , H 2 : { 0 , 1 } n × { 0 , 1 } n → Z q * , H 3 : G T → { 0 , 1 } n , and H 4 : { 0 , 1 } n → { 0 , 1 } n . The PKG is given master private key t ∈ Z q * and master public key T = tG.

Encrypt: Message M ∈ { 0 , 1 } n is encrypted to ciphertext (u, v, w) using Alice’s public identity string I D i ∈ { 0 , 1 } n as follows.

1) Map the identity string to point I A = H 1 ( I D i ) .

2) Apply the pairing μ = e ^ ( I A , T ) .

3) Select random σ ∈ { 0 , 1 } n .

4) Set exponent r to H 2 ( σ | | M ) .

5) Compute z = μ r .

6) Compute ciphertext ( u , v , w ) = ( r G , σ ⊕ H 3 ( z ) , M ⊕ H 4 ( σ ) ) .

Extract: To decrypt a message the recipient must present their I D i to a Private Key Generator (PKG). The algorithm first maps the string to a group point I A = H 1 ( I D i ) and then multiplies the point by the master private key to produce the decryption key K A = t I A . The decryption key K_A is returned to the caller.

Decrypt: The decryption algorithm applies the private key K_A to ciphertext (u, v, w) to obtain plaintext M.

1) Compute z = e ^ ( K A , u ) .

2) Compute σ = v ⊕ H 3 ( z ) .

3) M = w ⊕ H 4 ( σ ) .

4) Verify that u == rG: if these are equal, return M; if they are not equal, the ciphertext is rejected.

Boneh and Franklin define an adaptive chosen ciphertext notion of security IND-ID-CCA applicable to identity-based encryption, and three different variations of their protocol.

Brands Digital Credentials [5] [6] may be described in terms of three protocols: “setup”, “issue” and “show”.

Setup: During setup, the environment is initialized with p , q , g 0 , where p is a large prime q is the prime order of a multiplicative subgroup of Z p * , and g₀ is a generator of this q-order subgroup. Issuers of Digital Credentials are each initialized with a private key ( y 1 , y 2 , ⋯ , y m , x 0 ) where y 1 , y 2 , ⋯ , y m , x 0 ∈ Z q and a public key ( g 1 , g 2 , ⋯ , g m , h 0 ) , where g i = g 0 y i for i in [1, m] and h 0 = g 0 x 0 .

Issue: The issue protocol proceeds between an individual, Alice, and a credential issuer, say Bob, as follows.

1) Alice selects α ← R Z q and calculates h = ( g 1 x 1 g 2 x 2 ⋯ g m x m h 0 ) α mod p using Bob’s public key and her attributes ( x 1 , x 2 , ⋯ , x m ) . Alice retains h as the first part of the credential.

2) Bob selects w 0 ← R Z q and calculates a 0 = g 0 w 0 mod p which he sends to Alice.

3) Alice selects β , γ ← R Z q and calculates the second credential component c ′ 0 = H ( h | h 2 ) where h 2 = g 0 β ( ( g 1 x 1 g 2 x 2 ⋯ g m x m h 0 ) γ ) a 0 mod p . She sends a blinded version c 0 = ( c ′ 0 − β ) mod q to Bob for his signature.

4) Bob creates receives c₀ and creates signature material r 0 = ( w 0 − c 0 ) / ( x 0 + x 1 ∗ y 1 + x 2 ∗ y 2 + ⋯ + x m ∗ y m ) mod q and sends this r₀ to Alice.

5) Alice evaluates an issuance verification relation, confirming that g 0 c 0 ( g 1 x 1 g 2 x 2 ⋯ g m x m h 0 ) r 0 mod p is equal to a₀. If valid, she finalizes Bob’s signature to obtain r ′ 0 = ( r 0 + γ ) / α mod q and stores the issued credential ( h , c ′ 0 , r ′ 0 ) for later use in the showing protocol.

Show: Alice shows selected contents of her credential to verifier Victor as follows.

1) Alice sends the credential ( h , c ′ 0 , r ′ 0 ) to Victor.

2) Victor confirms the credential is valid by evaluating a verification relation, confirming that c ′ 0 is equal to H ( h | g 0 c ′ 0 h r ′ 0 mod p ) .

3) If the verification relation passes, Alice and Victor engage in a proof of knowledge protocol (a verification of a Boolean predicate on Alice’s credential attributes). Brands describes a variety of predicates in which Alice reveals the value of a required attribute and proves knowledge of the remaining attributes in the credential [5] [6] . One such predicate will be presented in the construction section of this document.

4) Following successful proof of knowledge, Victor provides Alice with a service or access to a resource. In the PP-IBE protocol, after integrity verification and proof of knowledge, the ICA in the role of verifier grants a pseudonym credential.

Brands [6] presents variations of the protocols including a version based on the RSA problem. This paper restricts itself to the protocol as described on the discrete logarithm problem [5] [6] . Brands digital credentials are used by Adams to sign and certify identity and pseudonym credentials. The nomenclature in our construction uses p' and q' for p and q above for integration with BF-IBE (which itself uses a p and q).

In [1] [2] , Adams proposes PP-IBE, an approach to reduce the amount of trust that must be placed in the PKG. PP-IBE uses digital credentials as both identity certificates and pseudonyms, and proposes a community of ICAs who certify these credentials. In this paper, we focus on the “augmented scheme” of PP-IBE in which Alice interacts with a community of ICAs to obtain a final pseudonym credential that is exchanged for keying material with the PKG.

Setup: The setup protocol of PP-IBE combines the setup activities of BF-IBE and DC, without introducing additional global (i.e., publicly accessible) data. Thus PP-IBE requires, for BF-IBE, a curve E ρ ( a , b ) with generator point G which generates the group G₁, and a bilinear map e ^ : G 1 × G 1 → G T . For DC, PP-IBE requires primes p' and q', and g₀, a generator of the q'-order subgroup of Z p ′ * .

Encrypt: Encryption proceeds as defined by BF IBE, thus using I A = H 1 (id_string) and μ = e ^ ( I A , T ) , producing ciphertext ( u , v , w ) which is sent to Alice. Alice requires the help of a community of ICAs and a PKG to decrypt the ciphertext.

Identity Credential Issuance. Alice obtains an identity credential from ICA_i as follows. 1) Alice sends her id_string to ICA_i who verifies Alice’s ownership. 2) ICA_i computes p 1 = I A = H 1 (id_string) and ξ p 1 = e ^ ( p 1 , p 1 ) . Alice and ICA_i engage in the Brands Issuing protocol with x 1 = ξ p 1 and x₂ = the id of ICA_i. On successful completion of the issuing protocol, Alice holds c r e d i = ( h , c ′ 0 , r ′ 0 ) , a signed identity credential enclosing a ξ p 1 certified by a trusted service provider.

Pseudonym Credential Issuance. Alice may choose to pseudonymize the identity credential issued by ICA_i. To do this, Alice selects another Intermediate Certification Authority, say ICA_j and proceeds as follows. 1) Alice sends cred_i, p_i, a t t r i = ( a 1 , a 2 ) i and s_j to ICA_j. 2) ICA_j applies the verification relation to confirm digital integrity of the credential. 3) If the credential passes the integrity check, Alice and ICA_j conduct a Brands proof of knowledge on attributes a 1 = ξ p 1 and a 2 = i d i . 4) ICA_j verifies provenance, confirming that that e ^ ( p i , p i ) = = a 1 i 5) Following successful verification of cred_i, ICA_j computes pseudonym point p j = p i ∗ s j , ξ j = e ^ ( p j , p j ) and proceeds with the Brands issuing protocol with

a t t r j = ( a 1 , a 2 ) j = ( a 1 j , a 2 j ) = ( ξ j , i d ( I C A j ) ) .

Alice may now choose to pseudonymize further: she can present cred_j, p_j, s_i to another authority (say, ICA_k), proving knowledge of attr_j. On successful verification, pseudonym p_k = s_j * p_j is created by ICA_k, and a new credential, cred_k, is issued to Alice. Using this process, Alice may create a chain of credentials on pseudonyms of any length she wishes. Note that the random values s_i, s_j, ∙∙∙ are retained by Alice for use in key extraction.

Key Extraction. In PP-IBE, key extraction is in two parts. First Alice provides a credential on a pseudonymized point p_k to the PKG. After verifying the credential and Alice’s proof of knowledge of the signed attributes, the PKG creates keying material K = t * p_k, where t is the PKG’s master secret key. This initial keying material is sent to Alice who creates the decryption key K_A by multiplying this K with the product of the inverses of the scalars used to create p_k, thus K_A = wK, where w = ∏ s i ∈ S s i − 1 ( mod q ) .

Decryption. After having successfully created K_A, Alice can decrypt ciphertext ( u , v , w ) as per the BF-IBE algorithm.

Note that in [1] [2] , PP-IBE uses two attributes within the credential (one for ξ and one for the id of the issuing ICA). However, in an actual implementation, the output of the pairing function (either the Weil or Tate pairing) will be a polynomial in the extension field p^k. For the supersingular curves on which we base our construction below, k = 2 and the pairing output will be a polynomial with two coefficients. Therefore, the credentials in our construction have been modified to contain three attributes (two for the coefficients of the pairing output and one for the id of the issuing ICA).

The parameter selection consists of finding a tuple of primes (q, p, q', p'). These values determine the main group sizes used in our construction PP-IBE. Parameter q sets the size of G₁; in our construction G₁ is q-torsion group of the base elliptic curve. Parameter p creates F_p, the prime field upon which the base elliptic curve is defined. Parameter p' creates Z p ′ the base field for digital credentials. Parameter q' is the order of the multiplicative subgroup of Z p ′ * ; digital credential attributes and other exponents are drawn from Z q ′ * .

The parameter selection algorithm is as follows:

1) Select q a prime.

2) Find p prime such that q | p + 1, q² ∤ p + 1 and p º 2 mod 3.

3) Set q' to p.

4) Find p' prime such that q' | p' - 1.

5) Return (q, p, q', p').

Given parameters (q, p, q', p') initialize the required mathematical objects:

1) Let p define the prime field F_p.

2) Set base curve E ( F p ) : y 2 = x 3 + 1 .

3) Set G₁ to be the torsion group E(F_p)[q].

4) Extension field F p 2 , curve on extension field E ( F p 2 ) : y 2 = x 3 + 1 , and corresponding torsion group E ( F p 2 ) [ q ] are created.

5) Set G ′ 1 to be E ( F p 2 ) [ q ] .

6) Set Z q ′ * , Z p ′ , Z p ′ * [ q ′ ] .

7) Return ( E ( F p ) [ q ] , E ( F p ) , E ( F p 2 ) , Z q ′ * , Z p ′ ).

The base curve E ( F p ) : y 2 = x 3 + 1 where p = 2 mod 3 has the following properties. It is a supersingular curve of order #E(F_p) = p + 1. Since q | p + 1, E(F_p) contains a torsion group E(F_p)[q] of order q. The curve E(F_p) also supports a distortion map φ ( x , y ) = ( ζ x , y ) where ζ ∈ F p 2 and ζ 3 = 1 .

The parameters (q, p, q', p') and mathematical objects ( E ( F p ) [ q ] , E ( F p ) , E ( F p 2 ) , Z q ′ * , Z p ′ * [ q ′ ] , Z p ′ ) are used to initialize the components of PP-IBE as follows:

1) Set G₁ to E ( F p ) [ q ] .

2) Set f : E ( F p ) [ q ] × E ( F p ) [ q ] → E ( F p 2 ) to the Weil (or Tate) pairing.

3) Define e ^ ( p , q ) ≜ f ( p , φ ( q ) ) where φ is the distortion map of E(F_p).

4) Set m, the number of attributes for digital credentials, to be 3.

5) Set Z q ′ * to be the field from which digital credential attributes and exponents are drawn.

6) Set Z p ′ * to be the base field of digital credentials.

7) Set G and G H 1 to be elements of G₁.

8) Set g₀ to be a generator of Z p ′ * [ q ′ ] .

Function H 1 : { 0 , 1 } * → G 1 * is implemented using G H 1 , a generator of G₁, which is multiplied by the SHA256 hash of the input string (this product is reduced modulo q). Function H 2 : { 0 , 1 } n × { 0 , 1 } n → Z q * takes the hash of the input strings, reduces it modulo q − 1 and adds one to the result. Function H 3 : G T → { 0 , 1 } n has the polynomial representation of the arguments and extracts the n least significant bits. Function H 4 : { 0 , 1 } n → { 0 , 1 } n hashes the input string and extracts the n least significant bits.

Use of Distortion Map. In PP-IBE, the identity token ξ p i = e ^ ( p i , p i ) requires that point p i ∈ G 1 be paired with itself. The Weil pairing f(P,Q) returns the degenerate result 1 when the inputs are linearly dependent, which is precisely the case in determining ξ p i . The problem is addressed by using the distortion map to implement a modified pairing function e ^ ( p , q ) = f ( p , φ ( q ) ) where f is a pairing such as the Weil or Tate pairing. The distortion map is defined as

φ ( x , y ) = ( ζ x , y ) where ζ ∈ F p 2 and ζ 3 = 1 . This map φ : ( F p ) → E ( F p 2 ) translates a point in E(F_p) to a linearly independent point in E ( F p 2 ) , which allows the pairing to be applied returning non-degenerate results.

Three-Base Credential. The modified pairing function uses the Weil or Tate pairing and returns ξ ∈ F p 2 , a degree-one polynomial with two coefficients F_p. Since q' = p, these coefficients may carried as attributes Z q ′ in the digital credential. There are different approaches to carrying ξ in the credential; however, we found that carrying both coefficients is convenient for calculations in key extraction. Thus, one attribute (and corresponding base) is added to PP-IBE as defined in [1] . Commensurate changes are required to the digital credential setup, issue, and verification protocols.

Choice of the Curve. A supersingular curve was chosen for two main reasons. First, the distortion map permits the pairing of p with itself. Second, this curve follows the construction given in [3] ; our worked example thus complements [3] and contributes to its body of knowledge. Note that by choosing this curve, we also benefit from the BDH generator and security proofs given in [3] .

Security Impact. From the perspective of elliptic curves and bilinear pairings, we refer to the discussion in [3] . The MOV reduction [9] can be applied to such supersingular curves as we have chosen for our construction. Thus as pointed out in [3] , care must be taken to choose parameters such that the discrete log G₁ = E(F_p)[q] remains difficult in G T = F p 2 . In addition to security in elliptic curves and bilinear maps, we must also consider the difficulty of the traditional discrete log problem due to use of the digital credentials. Parameter sizes are discussed in §5.

Issue_on_Point(). We introduce a function issue_on_point() which takes a point in G₁ and a scalar and can be used for issuing both credentials and pseudonyms. Identity credentials and pseudonym credentials are both issued based on some ξ i derived from a source point in G₁. The elegance of the algorithm allows one to be expressed in terms of the other. An “issue_on_point” algorithm has been implemented, which accepts a point and a scalar (as well as the other DC-required arguments) to produce a credential on the point resulting from the multiplication of the point and the scalar received as arguments. This protocol is called both by identity issuance and pseudonym issuance logic. If an identity credential is to be issued, the scalar has the value one and multiplication leaves the point unchanged. If a pseudonym credential is to be issued, the scalar is the s_i value selected by Alice to create the pseudonym. See Figure 2 for an illustration of the steps involved in credential issuance.

Group Parameters: First, group parameters are selected. We seek p, q, q', p' all prime with q | p + 1 and q 2   ∤   p + 1 , p = 2 mod 3, p ≠ 3 mod 4, q' = p, and q ′ | p ′ − 1 . Our worked example (a “toy” example with deliberately small numbers for readability and easy verifiability) uses q = 47, p = 281, q' = 281, and p' = 563.

Let q = 47, for a torsion group G₁ of size 47. Parameters o, p, q' and p' follow from this choice. Our construction uses a supersingular curve of the form E ( F p ) : y 2 = x 3 + 1 , where p = 2 mod 3, which has order o = # E ( F p ) = p + 1 . We require p prime such that q | p + 1 and q 2   ∤   p + 1 . For the worked example, we select p = 281, so that our base curve is E/F₂₈₁: y 2 = x 3 + 1 with G₁ = E(F₂₈₁) [47],

the set of points in E (F₂₈₁) with order 47, along with O . The order of the base curve o = #E (F_p) = 282 is divisible by q = 47. The embedding degree of our worked example is k = 2, the smallest positive integer k such that #G₁| #E (F_p)^k + 1. In our example, 47 | 282 k + 1 .

Credential Parameters: As per our construction, the output of the pairing function will be an element in the extension field F p 2 , a polynomial of degree one with coefficients in F_p. We carry the coefficients as attributes in the digital credential. The q' of the digital credential parameters must be large enough to accommodate these numbers. We set q' = p = 281. It remains only to find p', the modulus for digital credentials, such that q ′ | p ′ − 1 . For our worked example, we select p' = 563.

Generators: Select generator G = (1, 132) for IBE and g₀ = 3 for digital credentials.

The ICAs are each initialized with their DC key pairs in which private key K p r i v = ( y 1 , y 2 , y 3 , x 0 ) which are random values in Z q ′ and public key K p u b = ( g 1 , g 2 , g 3 , h 0 ) where g i = g 0 y i mod p ′ and h 0 = g 0 x 0 mod p ′ . The PKG is initialized with a BF-IBE key pair in which the master secret key is a random scalar in Z_q, say t = 23, and the public key is calculated as T = t ∗ G = 23 ∗ ( 1 , 132 ) = ( 252 , 202 ) . Select ζ = 68 b + 106 (here, ζ ∈ F p 2 and ζ 3 = 1 ). Table 1 presents the key pairs for the service providers of the scenario presented in the augmented scheme of [1] .

Encryption proceeds according to BF-IBE. Here, ciphertext ( u , v , w ) is created for M = “abc” (msg_bits: “011000010110001001100011”, of length n = 24) using Alice’s identity string “alice@gmail.com”.

First u is calculated. Alice’s identity string is first mapped to point I A ∈ G 1 = H₁ (“alice@gmail.com”) = (34, 33). Next the identity point I_A is paired with the master public key μ = e ^ ( I A , T ) . Recall that e ^ ( p 1 , p 2 ) = f ( p 1 , φ ( p 2 ) ) where φ ( x , y ) = ( ζ x , y ) , ζ = 68 b + 106 , f() is either the Tate or Weil pairing, and b is

an arbitrary symbolic variable to be used in polynomials in F p 2 . Using the Weil pairing, μ = weil_pairing ( I A , φ ( T ) ) = weil_pairing ( ( 34 , 33 ) , φ ( 252 , 202 ) ) = weil_pairing ( ( 34 , 33 ) , ( 276 b + 17 , 202 ) ) = 216 b + 147 . Let σ = “100101000111100011000010”, and r = H₂ (σ, msg_bits) = 43, then u = r ∗ G = 43 ∗ ( 1 , 132 ) = ( 263 , 167 ) .

The second component of the ciphertext, v, is calculated as follows. Calculate z = μ r = ( 216 b + 147 ) 43 = 21 b + 60 (where exponentiation is reduced modulo the Conway polynomial [15] [16] b² + 280b + 3) and let h3z = H₃(z, n) = 001100110011011000110001; then component v = sigma xor h3z = 101001110100111011110011.

The last component of the ciphertext is w = msg_bits Å H₄(σ). Assuming H₄(σ) = 011001100011010001100010, then w = 011000010110001001100011 Å 011001100011010001100010 = 000001110101011000000001.

The ciphertext of M = “abc” encrypted using Alice’s identity string “alice@gmail.com” is (u,v,w) = ((263, 167), 101001110100111011110011, 000001110101011000000001).

PP-IBE uses interactions between Alice and ICAs to certify her identity and pseudonym as precursors to interacting with the PKG to obtain the decryption keys.

Alice engages with ICA_i to obtain a digital credential ( h , c ′ 0 , r ′ 0 ) certifying her identity. For this worked example, we choose the following values at random: (α = 12, β = 6, γ = 2, w₀ = 8). As a first step, Alice calculates h on her own. She calculates her identity point p₁ = H₁ ('alice@gmail.com') = I_A = (34, 33). Following this, she calculates ξ i = e ^ ( p i , p i ) = weil_pairing ( p i , φ ( p i ) ) = weil_pairing ( ( 34 , 33 ) , ( 64 b + 232 , 33 ) ) = 13 b + 211 . Assuming service provider id = 27, Alice has attributes ( x 1 , x 2 , x 3 ) = ( 211 , 13 , 27 ) . Assuming α = 12, she calculates and retains h = ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) α mod p 1 = ( ( 243 211 ) ( 541 13 ) ( 498 27 ) ( 27 ) ) 12 mod 563 = 256 .

As her next step Alice calculates c ′ 0 = H ( h | h 2 ) with input a committed random from the ICA. ICA_i selects random w₀ (assume w₀ = 8), calculates a 0 = g 0 w 0 = 3 8 mod 563 , and sends a₀ to Alice. Alice uses a₀ to calculate h 2 = g 0 β ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) γ a 0 mod p ′ = 3⁶(243²¹¹ * 541¹³ * 498²⁷ * 27)² * 368 mod 563 = 99. This h₂ is combined with h to form c ′ 0 = H ( h | h 2 ) = SHA256(256|99) mod 281 = 204. This c ′ 0 will be the second component in the digital credential.

To calculate r ′ 0 , Alice initiates by sending c 0 = c ′ 0 − β mod q ′ = 204 – 6 mod 281 = 198 to ICA_i. The ICA calculates r 0 = ( w 0 − c 0 ) / ( x 0 + x 1 ∗ y 1 + x 2 ∗ y 2 + x 3 ∗ y 3 ) mod q ′ = ((8 - 198)/(3 + 211 * 5 + 13 * 9 + 27 * 7) mod 281 = 128 and returns it to Alice. Alice checks the integrity of the components using the verification relation: g 0 c 0 ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) r 0 mod p ′ = = a 0 . In this case both a₀ and 3¹⁹⁸ * ((243²¹¹) * (541¹³) * (498²⁷) * 27)¹²⁸ mod 563 are equal to 368, so the verification relation holds. Alice finalizes r ′ 0 = r 0 + γ / α mod q ′ = ( 128 + 2 ) / 12 mod 281 = 245 . Alice stores the finalized credential c r e d i = ( h , c ′ 0 , r ′ 0 ) = ( 256 , 204 , 245 ) for the next step in certifying a pseudonym with ICA_j.

As in the augmented scheme example from [1] , identity credential cred_i is used as an input in obtaining pseudonym credential cred_j from ICA_j, which is then used to obtain another pseudonym credential cred_k from ICA_k.

In general, to issue a pseudonym credential, the ICA conducts a verification of the previous credential and the proposed pseudonym, and then issues a new credential on the pseudonym.

ICA_j Issuance of Pseudonym Credential. Alice presents her identity credential cred_i in the showing protocol. ICA_j verifies this before issuing a pseudonym credential cred_j.

Alice sends cred_i = (256, 204, 245), p_i = (34, 33) and a scalar s_j = 25 to ICA_j, as input to the pseudonym service, which will yield a new credential cred_j = (440, 252, 63) on pseudonym point p_j = (199, 158). This process proceeds in two steps: first the submitted cred_i is verified, after that, the new cred_j is issued.

Verification of cred_i consists of three checks: the integrity check, the proof of knowledge, and the coefficients check. The integrity of cred_i is verified using the digital credentials verification relation. Given credential ( h , c ′ 0 , r ′ 0 ) verify that c ′ 0 = = H ( h | g 0 c ′ 0 h r ′ 0 ) Thus with cred_i = (256, 204, 245), g 0 c ′ h r ′ 0 = (3²⁰⁴) (256²⁴⁵) mod 563 = 99. This value corresponds to the h₂ calculated during the issuing protocol, so H ( h | g 0 c ′ 0 h r ′ 0 ) = 204 which is equal to c ′ 0 , which satisfies the verification relation.

The next step is the proof of knowledge. For this example, let’s assume random values w = 6 and c = 7. ICA_j creates a random challenge c = 7, and sends it to Alice who creates p r o o f i = ( c ′ , x 1 , x 2 , x 3 ) = ( 30 , 211 , 13 , 27 ) where the value for c ′ = c / α + w mod q = 7 / 12 + 6 mod 281 = 30 and x 1 , x 2 , x 3 are Alice’s attributes for cred_i. Alice sends p r o o f i to ICA_j who verifies it by confirming the equality of h c ′ a mod p' = (256³⁰)363 mod 563 = 485 with g 1 x 1 g 2 x 2 g 3 x 3 h 0 c = (243^211*7)(541^13*7)(76^27*7)(27⁷) mod 563 = 485; thus proof of knowledge has been confirmed.

In the final verification step, ICA_j verifies that cred_i is on the coefficients of ξ_i. In this case correspondence is confirmed: e ^ ( p i , p i ) = 13 b + 211 , the coefficients of which correspond to the (x₁, x₂) received in the proof, above.

After this successful verification of cred_i, ICA_j issues a pseudonym credential to Alice. Let’s assume the random values for the issue protocol to be α = 19, β = 26, γ = 32, w₀ = 18. ICA_j calculates new point p_j = p_i * s₁ = (34, 33) * 25 = (199, 158) and ξ_j = ê(p_j, p_j) = ê((199, 158), (199, 158)) = weil_pairing((199, 158), phi((199, 158))) = weil_pairing((199, 158), (44b + 19, 158)) = 151b + 29. Assuming id(ICA_j) = 11, the credential is constructed on attributes (x₁ = 29, x₂ = 151, x₃ = 11). Alice calculates and retains h = ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) α mod p 1 = ((289²⁹)(326¹⁵¹)(349¹¹)(470))¹⁹ mod 563 = 440.

Next ICA_j selects random w₀=18 and calculates a 0 = g 0 w 0 = 3 18 mod 563 = 484 , which it sends to Alice. Alice calculates c ′ 0 = H ( h | h 2 ) where h = 197 and h 2 = g 0 β ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) γ a 0 mod p ′ = 3²⁶((289²⁹)(326¹⁵¹)(349¹¹)(470))³²484 mod 563 = 425, thus c ′ 0 = H ( 440 | 425 ) = 252 . Alice retains this c ′ 0 and calculates c 0 = ( c ′ 0 − β ) mod q 1 = (252 - 26) mod 281 = 226 which is sent to ICA_j. ICA_j produces signature data r 0 = ( w 0 − c 0 ) / ( x 0 + x 1 y 1 + x 2 y 2 + x 3 y 3 ) mod q ′ = (18 - 226)/(13 + 29 * 15 + 151 * 19 + 11 * 17) mod 281 = 41, which is sent to Alice. Alice evaluates the issue-time verification relation, confirming that g 0 c 0 ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) r 0 mod p ′ = 3²²⁶((289²⁹)(326¹⁵¹)(349¹¹)(470))⁴¹ mod 563 = 484 equals the expected value of a₀ = 484. Alice proceeds to unblind the signature r ′ 0 = ( r 0 + γ ) / α mod q ′ = (41 + 32)/19 mod 281 = 63 and stores the resulting credential cred_j = (440, 252, 63).

ICA_k Issuance of Pseudonym Credential. Alice uses pseudonym credential cred_j to obtain another pseudonym credential with ICA_k. Alice enters into the “show” protocol, supplying cred_j = (440, 252, 63), attr_j = (x₁ = 29, x₂ = 151, x₃ = 11), p_j = (199, 158) and s₂ = 17. ICA_k first checks the time verification relation for cred_j: c ′ 0 = = H ( h | g 0 c ′ 0 h r ′ 0 ) . Here c ′ 0 = 252, h = 440, and g 0 c ′ 0 h r ′ 0 mod p ′ = 3²⁵²440⁶³ mod 563 = 425, thus, the hash H(440|425), evaluates, as above, to 252 which is equal to c ′ 0 . The verification relation is satisfied for cred_j.

The proof of knowledge follows the verification relation. ICA_k creates a random challenge, say c = 8, and sends it to Alice who creates p r o o f j = ( c ′ , x 1 , x 2 , x 3 ) = (37, 29, 151, 11) where c' = c/α + w mod q = 8 /19 + 7 mod 281 = 37 and x₁, x₂, x₃ are the attributes attr_j. Alice sends proof_j to ICA_k who verifies it by confirming that h c ′ a = = g 1 x 1 g 2 x 2 g 3 x 3 h 0 c mod p ′ . Here, h c ′ a mod p ′ = (440³⁷)381 mod 563 = 99 and g 1 x 1 g 2 x 2 g 3 x 3 h 0 c = (289^29*8)(326^151*8)(349^11*8)(470⁸) mod 563 = 99; thus the proof of knowledge verifies correctly.

For the last verification step, ICA_k performs a pairing and confirms that the coefficients of ξ j = e ^ ( p j , p j ) = e ^ ( ( 199 , 158 ) , ( 199 , 158 ) ) = 151 b + 29 correspond to (x₁ =29, x₂ = 151) of cred_j.

Once cred_j has been verified, ICA_k proceeds to issue pseudonym credential cred_k to Alice. For the issuance of cred_k assume values of α = 7, β = 26, γ = 22, w₀ = 28 for the random values of the issue protocol.Alice calculates her new point p_k = p_j * s₂ = (199 , 158) * 17 = (99, 179) and ξ_k = ê(p_k, p_k) = ê((99, 179), (99, 179)) = weil_pairing ((99 , 179), phi((99, 179))) = weil_pairing((99, 179), (269b + 97, 179)) = 197b + 190. Assuming id(ICA_k) = 42, attributes attr_k = (x₁ = 190, x₂ = 197, x₃ = 42) are used for issuance of cred_k.

Credential c r e d k = ( h , c ′ 0 , r ′ 0 ) is calculated as follows. First, Alice calculates and retains h = ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) α mod p 1 = ((68¹⁹⁰)(441¹⁹⁷)(49⁴²)(508))⁷ mod 563 = 92. Alice sends p_j = (199, 158) and s₂ = 17 to ICA_k, who calculates the same attr_k. Next ICA_k selects a random w₀, say the value 28, and calculates a 0 = g 0 w 0 = 3²⁸ mod 563 = 147 and sends this a₀ to Alice. Alice calculates c ′ 0 = H ( h | h 2 ) where h = 92 and h 2 = g 0 β ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) γ a 0 mod p ′ = 3²⁶(68¹⁹⁰ * 441¹⁹⁷ * 49⁴² * 508)²² * 147 mod 563 = 513, so c ′ 0 = H ( 92 | 513 ) = 240 . Alice retains c ′ 0 and calculates c 0 = ( c ′ 0 − β ) mod q 1 = ( 240 − 26 ) mod 281 = 214 and sends it to ICA_k. Finally, ICA_k produces signature data r 0 = ( w 0 − c 0 ) / ( x 0 + x 1 y 1 + x 2 y 2 + x 3 y 3 ) mod q ′ = ((28 - 214)/(23 + 190 * 25 + 197 * 29 + 42 * 27)) mod 281 = 211, which is sent to Alice. Alice evaluates the issuance-time verification relation, confirming that g 0 c 0 ( g 1 x 1 g 2 x 2 g 3 x 3 h 0 ) r 0 mod p ′ = 3²¹⁴((68¹⁹⁰)(441¹⁹⁷)(49⁴²)(508))²¹¹ mod 563 = 147 which equals a₀, as expected. Alice proceeds to unblind the signature r ′ 0 = ( r 0 + γ ) / α mod q 1 = (211 + 22)/7 mod 281 = 234 and stores the resulting credential cred_k = (92, 240, 234), along with the attributes and other parameters she used to obtain it.

Alice sends credential cred_k = (92, 240, 234) and pseudonymous point p_k = (99, 179) to the PKG with supporting attributes (190, 197, 42). The PKG checks the verification relation: c ′ 0 = = H ( h | g 0 c ′ 0 h r ′ 0 ) , with h = 92, and g 0 c ′ 0 h r ′ 0 = 3²⁴⁰ * 92²³⁴ mod 563 = 513, thus H(92|513) = SHA256(92|513) mod 281 = 3b11806f98cd81d368137bb211c63561bff95c219fc5b6649501708d0e14693b mod 281 = 240 which indeed equals c ′ 0 , so the verification relation holds.

The PKG’s next step in checking cred_k is the proof of knowledge. Proof of knowledge proceeds with the PKG generating random value w = 8 and Alice generating proof (c' = (9/7 + 8) mod 281 = 210, x₁ = 190, x₂ = 197, x₃ = 42). The PKG evaluates (h^c')a = (92²¹⁰)271 mod 563 = 201 and confirms that it is equal to ( g 1 x 1 ∗ c ) ( g 2 x 2 ∗ c ) ( g 3 x 3 ∗ c ) ( h 0 c ) = ( 68 190 ∗ 9 ) ( 441 197 ∗ 9 ) ( 49 42 ∗ 9 ) ( 508 9 ) mod 563. Finally, the PKG confirms that the coefficients of ξ k = e ^ ( p k , p k ) = 197 b + 190 correspond to attributes (x₁, x₂).

Once cred_k has been verified, the PKG creates the keying material by multiplying the pseudonymous point p_k = (99, 179) with PKG private master key t = 23 to obtain keying material K = t * p_k = 23 * (99, 179) = (34, 248). This keying material is sent to Alice.

To finalize her decryption key, Alice applies the scalars she retained during pseudonym creation to the keying material received from the PKG to obtain K_A = ((s₁s₂)⁻¹ mod q) * K = ((25 * 17)⁻¹ mod 47) * (34, 248) = 24 * (34, 248) = (111, 206). Alice had received ciphertext ( u , v , w ) = ( ( 263 , 167 ) , 101001110100111011110011 , 000001110101011000000001 ) from Bob. She proceeds to decrypt it using the decryption key K_A = (111, 206).

First, she computes z = e ^ ( K A , u ) = e ^ ( ( 111 , 206 ) , ( 263 , 167 ) ) = 21 b + 60 . Then she derives σ = v ♁ H₃(z) = 101001110100111011110011 Å H₃(21b + 60) = 101001110100111011110011 Å 001100110011011000110001 = 100101000111100011000010. Using σ, she calculates the plaintext M = w Å H₄(σ)) = 000001110101011000000001 Å 011001100011010001100010 = 011000010110001001100011. Alice confirms the verification relation: u == r * G = 43 * (1, 132) which is equal to u = (263, 167), the first component in the ciphertext, so the ciphertext is confirmed to be valid. Encryption returns the string value of M, which is “abc”.

The worked example uses small numbers for the sake of illustration. In an IBE deployment, the group parameters must be selected so that identity attacks on G₁ and forgery attacks on the digital credential are cryptographically hard. The parameter generation algorithm described in Section 5 can be modified to set target security sizes for F_p and Z p ′ . For 128-bit security, we would seek |q| ³ 254 bits and |p'| ³ 3072 bits [17] . If we want 128 bits of security, we will need p to be at least 1536 bits in length (so that the group size in F p 2 is at least 3072 bits long). One possible combination of parameters is shown in Table 2.

The required constraints hold on the above parameters. All numbers are prime, and all required relationships hold, namely that q | p + 1, p º 2 mod 3, p ≠ 3 mod 4, q² ∤ p+1, and q' | p' – 1.

We also note that other (i.e., non-supersingular) elliptic curves may be used to obtain a security level of 128 bits (or higher) with a smaller value of p. For example, BLS12-381 and BLS12-440 curves have an embedding degree of k = 12, allowing a significant reduction in the size of p (which, of course, would lead to a corresponding increase in the efficiency of computations involving p); see [18] . However, these so-called Type 3 curves use an asymmetric pairing ( e ^ : G 0 × G 1 → G T ), rather than a symmetric pairing ( e ^ : G 1 × G 1 → G T ), which would then require a modification to how pairings are used for pseudonym construction in PP-IBE.

Security Model. Boneh and Franklin [3] [4] define IND-ID-CCA, a form of chosen ciphertext security applicable to IBE schemes. IND-ID-CCA defines adaptive security in which the attacker attempts to demonstrate an advantage at decrypting a ciphertext for a chosen identity. The Attacker is given a choice of which identity to attack, the option of knowing the decryption keys for a set of independent identities, and oracle access to the private key extraction algorithm and to the decryption algorithm.

Construction: Boneh and Franklin present a construction based on p º 2 mod 3 with its accompanying distortion map. Our example proceeds with such a curve and is, as such, complimentary material for researchers in the area.

Distribution of Trust: A large amount of trust is placed in the PKG in an IBE deployment. All users obtain their decryption keys from the PKG using their public identity string. The PKG is thus able to derive private keys for all users. Adams’ architectural approach wipes out this complete knowledge, displacing it across the community of ICAs instead. The initial ICA provides a verification of ownership of the identity string (for example, using a challenge and response email pattern). The subsequent ICA issues a pseudonym credential on the trust of the previous ICA’s identity proofing mechanisms. Thus, the full trust that had previously been placed in the PKG is now spread out across the service providers:

· At the beginning of this chain of trust, the first ICA issues an identity credential, verifying Alice’s ownership of the identity string, and then maps that string to a point (using a map-to-point function H₁(.) or its stronger “admissible encoding” counterpart L(.); see below).

· The subsequent ICAs in the chain each issue a pseudonym on the basis of their trust in the integrity and processes of the peers that precede them in the chain, the strength of the signatures, and the quality of the map-to-point function.

Admissible Encoding: Of the variations presented in [3] [4] , only FullIdent’ is IND-ID-CCA secure. The algorithms for FullIdent and FullIdent’ are identical, differing only differ only in terms of the definition of H₁(.). FullIdent’ tightens requirements on the mapping, such that the distribution is provably uniformly random. In FullIdent', p₁ = H₁(id_string) is replaced with p 1 = L ( H ′ 1 ( i d _ s t r i n g ) ) where H ′ 1 ( . ) is uniform string hashing and L(.) is uniform point mapping. This is referred to as an “admissible encoding”. The H₁ used in this implementation conforms to FullIdent requirements but has not (yet) been verified against FullIdent’ requirements.