An Improvement on the BGH Cryptosystem

Abstract

The three main IBE schemes, i.e., Boneh–Franklin, Cocks and Boneh–Gentry–Hamburg present both strengths and weaknesses. In this paper, we introduce a more efficient variant of BGH (while preserving receiver’s anonymity) based on the work of Jhanwar and Barua. More precisely, we provide the reader with a scheme with reduced complexities for encryption and decryption algorithms and present a new perspective on the initial set of solutions.

1. Introduction

To sidestep various challenges associated with public-key cryptography, such as trust management and public key retrieval, Shamir introduced a novel concept in 1984: Identity-Based Encryption (IBE) [1]. In this framework, the public key is directly derived from a unique information of the user, like a personal number or an email address, and therefore removing the traditional key management processes, such as certificate issuance and revocation, but relying on a trusted Private Key Generator (PKG) to generate and distribute private keys securely.

Nevertheless, development of a practical IBE scheme was delayed until 2001, when two distinct schemes were introduced. In essence, Boneh and Franklin proposed the first such scheme via bilinear maps [2]. The security of this cryptosystem is proved under the Bilinear Diffie–Hellman assumption, but these schemes are difficult to instantiate efficiently and securely. Subsequently, during the same year, Cocks presented an alternative, more natural scheme based on quadratic residues [3]. The entire theory behind this cryptosystem was rigorously analyzed [2,4,5,6,7] and developed [8,9,10,11]. The main drawback of all these schemes is the large plaintext-to-ciphertext expansion.

Regarding ciphertext expansion, the most efficient anonymous IBE scheme is the one developed by Boneh, Gentry, and Hamburg [12] in 2007. This work is also defined on quadratic residues, but using a different approach. In [13], the authors managed to obtain a tighter security margin for one of BGH versions. The main limitation of BGH schemes are considered to be their inefficient bit-by-bit encryption and decryption processes, which are quartic in the security parameter. Jhanwar and Barua offered an inside-look in the theory behind this cryptosystem [14] and tried to improve the original scheme, but as in many other papers, some security issues were later identified.

Finally, in 2008, Gentry, Peikert and Vaikuntanathan designed a series of cryptographic algorithms, including an IBE scheme, based on lattices [15] in random oracle model. This scheme drew the attention of experts and allowed the development of hierarchical IBE schemes [16,17] in the standard oracle model. The main downside of lattice-based IBE schemes is the plaintext-to-ciphertext expansion and the large keys.

This work builds upon the well-known IBE scheme BGH, proposing a more efficient variant of it. More precisely, we present an algorithm to keep the synchronization between receiver’s and sender’s parameters by removing the requirement of solving a new equation for each message bit and we offer a new look upon the initial set of solutions.

Structure of the Paper

We present definitions and notations used throughout the article in Section 2. The proposed algorithm is introduced in Section 3. The security analysis is treated in Section 4. The conclusion is presented in Section 5.

2. Preliminaries

2.1. Notations

Throughout the paper, we use the notations presented in Table 1.

Table 1. Notations.

Notation	Description
$\lambda$	Security parameter
$x\stackrel{\$}{\leftarrow }X$	Selection of a random element x from a set X
$x=y$	Assignment of value y to the variable x
$x\left|\right|y$	Bit concatenation of $x,y$
$\left|X\right|$	Cardinality of set X
$\left|x\right|$	Bit length of x
$Pr\left[E\right]$	Occurrence probability of the event E
${\displaystyle \left(\frac{t}{N}\right)}$	Jacobi symbol of an integer t modulo an integer N
${\displaystyle [a,b]}$	Set $\{a,a+1,\dots ,b\}$
$Q{R}_N$	Set of quadratic residues modulo an integer N
$QN{R}_N$	Set of quadratic non-residues modulo an integer N
$J_N$	Set of integers modulo N with the Jacobi symbol 1
$\mathcal{O}\left(x\right)$	A function of magnitude x

2.2. Identity-Based Encryption

An IBE scheme comprises four probabilistic polynomial time (PPT) algorithms: Setup, KeyGen, Enc, and Dec. The Setup algorithm takes a security parameter as input and outputs the master secret key $MSK$ and the public parameters $PP$. The KeyGen algorithm uses an identity $ID$, the master secret key, and the public parameters to generate a private key $SK$ linked to $ID$. The Enc algorithm encrypts a message m using a key derived from an identity $ID$ and the public parameters, resulting in the ciphertext c. Finally, the Dec algorithm decrypts c using the private key associated with $ID$, recovering the original message m.

Definition 1

(Anonymity and Indistinguishability under Selective Identity and Chosen Plaintext Attacks—anon-ind-id-cpa). The  anon-ind-id-cpa  security of an IBE scheme $\mathcal{S}$ is characterized via the following adaptive game between an adversary $\mathcal{A}$ and a challenger C:

• Setup$\left(\lambda \right)$: The challenger C generates the public parameters $pp$, and the master key $msk$ sends $pp$ to adversary $\mathcal{A}$ and retaining $MSK$ to himself.
• Queries: The adversary issues a finite number of adaptive queries. A query can be one of the following types:

  1. 

  Private key query: When the adversary requests a query for an identity $ID$, C runs KeyGen($ID,MSK,PP$) and returns $SK$, the resulting private key, to $\mathcal{A}$.

  2. 

  Encryption query. The adversary is restricted to a single such query. The challenger receives from A two pairs $(I{D}_0,m_0),(I{D}_1,m_1)$ consisting of the identities $I{D}_0,I{D}_1$ and two equally large plaintexts $m_0,m_1$. The challenger randomly generates a bit $b\stackrel{\$}{\leftarrow }\{0,1\}$, runs the algorithm $Enc(m_b,I{D}_b,PP)$ and the resulting ciphertext c is sent to the adversary. Private-key queries for identities $I{D}_0,I{D}_1$ must never be issued.

• Guess: The adversary wins the game if it outputs a bit $b^{\prime }$ such that $b^{\prime }=b$.

When attacking an IBE scheme, the advantage of the adversary $\mathcal{A}$ is defined as

$$\begin{array}{c}\hfill {\mathrm{IBEAdv}}_{\mathcal{A},\mathcal{S}}\left(\lambda \right)=|Pr[b=b^{\prime }]-1/2|,\end{array}$$

where the probability is computed over the random bits used by both the challenger and the adversary. An IBE scheme is  anon-ind-id-cpa  secure, if for any PPT adversary $\mathcal{A}$ the advantage $\mathrm{IBEAd}{v}_{\mathcal{A},\mathcal{S}}\left(\lambda \right)$ is negligible. Notice that when the above game is restricted to $I{D}_0=I{D}_1$, it presents the notion of  ind-id-cpa  security.

The security of the IBE scheme presented in this paper relies on the Interactive Quadratic Residuosity assumption shown in Definition 3. This assumption states that QR assumption, presented in Definition 2, holds relative to a square root oracle.

Definition 2

(Quadratic Residuosity—qr).  Consider two large prime numbers $p,q\ge 2^{\lambda }$ and determine their product $N=pq$. Let $\mathcal{A}$ be a PPT algorithm that outputs 1 on input $(x,N)$ if $x\in Q{R}_N$. The advantage ${ADV}_{\mathcal{A}}^{\mathrm{Q}\mathrm{R}}\left(\lambda \right)$ is defined as

$$\begin{array}{c}\hfill \left|Pr[\mathcal{A}(x,N)=1|x\stackrel{\$}{\leftarrow }Q{R}_N]-Pr[\mathcal{A}(x,N)=1|x\stackrel{\$}{\leftarrow }{J}_n\setminus Q{R}_N]\right|.\end{array}$$

The Quadratic Residuosity assumption states that for any PPT algorithm $\mathcal{A}$ the advantage ${ADV}_{\mathcal{A}}^{\mathrm{Q}\mathrm{R}}\left(\lambda \right)$ is negligible.

Definition 3

(Interactive Quadratic Residuosity—iqr).  Let $p,q\ge 2^{\lambda }$ primes and $N=pq$. Consider a hash function $H_N:{\{0,1\}}^{\ast }\to J_N$. Let $\mathcal{O}$ be a square root oracle that selects $u_N\in J_N\setminus Q{R}_N$. This oracle takes an input pair $(N,x)$ and outputs either a square root of $H_N\left(x\right)$ or a square root of $u_N{H}_N\left(x\right)$, depending on which is a quadratic residue. The oracle $\mathcal{O}$ is chosen uniformly at random from all possible such functions. The advantage ${ADV}_{{\mathcal{A}}^{\mathcal{O}}}^{\mathrm{I}\mathrm{Q}\mathrm{R}}\left(\lambda \right)$ is defined as

$$\begin{array}{c}\hfill \left|Pr[{\mathcal{A}}^{\mathcal{O}}(x,N)=1|x\stackrel{\$}{\leftarrow }Q{R}_N]-Pr[{\mathcal{A}}^{\mathcal{O}}(x,N)=1|x\stackrel{\$}{\leftarrow }{J}_n\setminus Q{R}_N]\right|.\end{array}$$

The Interactive Quadratic Residuosity assumption states that for any PPT algorithm $\mathcal{A}$ with access to oracle $\mathcal{O}$, the advantage ${ADV}_{\mathcal{A}}^{\mathrm{I}\mathrm{Q}\mathrm{R}}\left(\lambda \right)$ is negligible.

2.3. Boneh–Gentry–Hamburg Cryptosystem

In [12], the authors introduced two IBE cryptosystems based on quadratic residues, BasicIBE and AnonIBE. We will focus our attention on the latter and introduce it.

During the encryption and decryption processes, the secret parameter s of the sender and the private key r of the receiver are used in a synchronization procedure between the sender and the receiver in order to ensure the correctness of the decryption and the anonymity of the receiver. To achieve synchronization, both parties use a deterministic algorithm ${\mathcal{Q}}^{\prime }$ as introduced in [12]. This algorithm takes as input $(N,u,R,S)$, where $N\in \mathbb{Z}$ is an RSA modulus, $S\in Q{R}_N$ is the square of the secret value s modulo N, $R\in J_N$ is a hash value based on the identity of the receiver and $u\in J_N\setminus Q{R}_N$. The output consists of four first-degree polynomials $f,\overline{f},g,\tau \in {\mathbb{Z}}_N\left[x\right]$. The synchronization is achieved if these polynomials satisfy the following conditions:

• Condition 1: If $R,S\in Q{R}_N$, then $f\left(r\right)g\left(s\right)\in Q{R}_N,$ for all $r,s\in {\mathbb{Z}}_N$, such that $r^2=RmodN$ and $s^2=SmodN$.
• Condition 2: If $uR,S\in Q{R}_N$, then $\overline{f}\left(\overline{r}\right)g\left(s\right)\tau \left(s\right)\in Q{R}_N,$ for all $\overline{r},s\in {\mathbb{Z}}_N$, such that ${\overline{r}}^2=uRmodN$ and $s^2=SmodN$.
• Condition 3: If $R\in Q{R}_N$, then $f\left(r\right)f(-r)S$ is a quadratic residue for all $r\in {\mathbb{Z}}_N$, such that $r^2=RmodN$.
• Condition 4: If $uR\in Q{R}_N$, then $\overline{f}\left(\overline{r}\right)\overline{f}(-\overline{r})S$ is a quadratic residue for all $\overline{r}\in {\mathbb{Z}}_N$, such that ${\overline{r}}^2=uRmodN$.
• Condition 5: If $S\in Q{R}_N$, then $\tau \left(s\right)\tau (-s)u$ is a quadratic residue for all $s\in {\mathbb{Z}}_N$, such that $s^2=SmodN$.
• Condition 6: Function $\tau$ does not depend by R, i.e., for all $R\in J_N$ algorithm ${\mathcal{Q}}^{\prime }(N,u,R,S)$ produce the same $\tau$ when $N,u,S$ are constant inputs.

The authors of [12] proposed as a starting point for generating these polynomials the modular quadratic Diophantine equation with coefficients $A,B\in {\mathbb{Z}}_N$

$$\begin{array}{c}\hfill E(A,B,N):A{x}^2+B{y}^2=1modN.\end{array}$$

(1)

Both parties consider the equations $E(R,S,N)$ and $E(u,S,N)$ with solutions $(x_0,y_0)$ and $({\alpha }_0,{\beta }_0)$, respectively. The previous conditions are satisfied and synchronization is achieved, as proven in [12], when polynomials $f,\overline{f},g,\tau$ are initiated as

$$\begin{array}{cccc}\hfill f\left(r\right)& =x_{0}r+1\hfill & \hfill \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}g\left(s\right)& =2y_{0}s+2\hfill \\ \hfill \overline{f}\left(\overline{r}\right)& =1+S{y}_0{\beta }_0+{\alpha }_0{x}_0\overline{r}\hfill & \hfill \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\tau \left(s\right)& =1+{\beta }_{0}s.\hfill \end{array}$$

Remark 1.

In [12], the authors present an algorithm based on the work of Cremona and Russin [18] to solve Equation (1). This algorithm is quartic in the security parameter λ.

We further present AnonIBE as it was introduced in [12].

• Setup$\left(\lambda \right)$: Given a security parameter $\lambda$, generate two primes $p,q\stackrel{\$}{\leftarrow }\mathbb{N}$ such that $p,q>2^{\lambda }$ and set $N=pq$. Randomly generate $u\stackrel{\$}{\leftarrow }{J}_N\setminus Q{R}_N$. Consider the public parameters $PP=\{N,u,H\}$, where the hash function $H:\mathcal{ID}\times [1,𝓁]\to J\left(n\right)$. Let the master secret key be $MSK=\{p,q,K\}$, where K is a uniformly random key for a pseudorandom function $F_K:ID\times [1,𝓁]\to \{0,1,2,3\}$.
• KeyGen$(ID,PP,MSK,𝓁)$: On input $ID,PP,MSK$ and a message bit-length 𝓁, the algorithm generates a decryption key $S{K}_{ID}$. For $i\in [1,𝓁]$ do:
  • Let $R_i=H(ID,i)$ and $\rho =F_k(ID,i)$;
  • Consider $b\in {\mathbb{Z}}_2$ such that $u^b{R}_i\in Q{R}_N$;
  • Consider $\{{\zeta }_0,{\zeta }_1,{\zeta }_2,{\zeta }_3\}$ the four roots of $u^b{R}_i$ modulo N;
  • Set $r_i={\zeta }_{\rho }$.

Generate $S{K}_{ID}=\{r_1,\dots ,r_{𝓁}\}$.

• Encrypt$(ID,PP,m)$: In order to encrypt a message $m\in {\{-1,1\}}^{𝓁}$ when given $ID,PP$, the sender randomly generates $s\stackrel{\$}{\leftarrow }{\mathbb{Z}}_N$, sets $S=s^{2}modN$ and gets the polynomial $\tau$ by running the algorithm $Q^{\prime }(N,u,1,S)$. For each $i\in [1,𝓁]$ consider $R_i=H(ID,i)$, find $g_i$ by running the algorithm $Q^{\prime }(N,u,R_i,S)$ and compute ${\displaystyle c_i=m_i·\left(\frac{g_i\left(s\right)}{N}\right)}$. The ciphertext is $C=(S,c_1,\dots ,c_{𝓁},k)$, where ${\displaystyle k=\left(\frac{\tau \left(s\right)}{N}\right)}$.
• Decrypt$(C,S{K}_{ID},PP)$: To decrypt the ciphertext C, generate for each $i\in [1,𝓁]$$R_i=H(ID,i)$ and the polynomials $(f_i,\overline{f_i},g_i,\tau )=Q^{\prime }(N,u,R_i,S)$. Then

  $$\begin{array}{cc}\hfill & \mathrm{if}{R}_i=r_i^{2}modN,\mathrm{then}{m}_i=c_i·\left({\displaystyle \frac{f_i\left(r_i\right)}{N}}\right)\hfill \\ \hfill & \mathrm{else}{m}_i=c_i·k·\left({\displaystyle \frac{{\overline{f}}_i\left(r_i\right)}{N}}\right).\hfill \end{array}$$

The recovered message is $m=m_1\left|\right|m_2\left|\right|\dots \left|\right|m_{𝓁}$.

3. BGH-like Cryptosystem

We further present a more efficient version of the previous scheme. The sender is required to solve only 2 equations instead of $2𝓁$ equations and the receiver must solve at most 2 equations instead of $𝓁+1$.

During the encryption and decryption processes two hash functions will be needed, namely $H:\mathcal{ID}\to J_N$, which takes the identity $ID$ and returns $R\in J_n$ and $H_1:{\{0,1\}}^{\ast }\to {\mathbb{Z}}_N$, which will take as input the identity-related R, the value S and the message bits that were already sent or received. Consider message bit $-1$ as 1 and message bit 1 as 0. We will refer to the following scheme as EffIBE.

• Setup$\left(\lambda \right)$: Given a security parameter $\lambda$, generate two primes $p,q\stackrel{\$}{\leftarrow }\mathbb{N}$ such that $p,q>2^{\lambda }$ and compute their product $N=pq$. Randomly generate $u\stackrel{\$}{\leftarrow }{J}_N\setminus Q{R}_N$, consider the public parameters $PP=\{N,u,H,H_1\}$ and the master secret key $MSK=\{p,q\}$.
• KeyGen$(ID,PP,MSK)$: Let $R=H\left(ID\right)$. If $R\in Q{R}_N$, then compute $r=R^{1/2}modN$. Otherwise, set $r={\left(uR\right)}^{1/2}modN$. The private key is $S{K}_{ID}=\left\{r\right\}$.
• Encrypt$(ID,PP,m\in {\{-1,1\}}^{𝓁})$: Let $R=H\left(ID\right)$. Randomly generate $s\stackrel{\$}{\leftarrow }{\mathbb{Z}}_N$ and set $S=s^{2}modN$. Apply algorithm ${\mathcal{Q}}^{\prime }$ to obtain

  $$(f_1,g_1,{\overline{f}}_1,\tau )={\mathcal{Q}}^{\prime }(N,u,R,S).$$
  Compute the first ciphertext bit as

  $$\begin{array}{c}\hfill c_1=m_1·\left({\displaystyle \frac{g\left(s\right)}{N}}\right).\end{array}$$
  For each $i\in [2,𝓁]$ and each plaintext bit $m_i$, consider the concatenation of the previously sent message bits $M_{i-1}=m_1\left|\right|m_2\left|\right|\dots \left|\right|m_{i-1}$, compute the hash value $L_i\in {\mathbb{Z}}_N$, where $L_i=H_1(R,S,M_{i-1})$. Let the ith set of polynomials $(f_i,g_i,{\overline{f}}_i)$ be

  $$\begin{array}{cc}\hfill f_i\left(j\right)& =x_{i}j+1,\hfill \\ \hfill g_i\left(j\right)& =2y_{i}j+2,\hfill \\ \hfill {\overline{f}}_i\left(j\right)& =1+S{y}_i{\beta }_0+{\alpha }_0{x}_{i}j,\hfill \end{array}$$

  where $x_i,y_i$ are considered as

  $$\begin{array}{cc}\hfill x_i& ={\displaystyle \frac{S{x}_{i-1}-R{L}_i^2{x}_{i-1}-2S{L}_i{y}_{i-1}}{S+R{L}_i^2}}modN,\hfill \\ \hfill y_i& ={\displaystyle \frac{R{L}_i^2{y}_{i-1}-2R{L}_i{x}_{i-1}-S{y}_{i-1}}{S+R{L}_i^2}}modN.\hfill \end{array}$$
  Define the ciphertext as $C=(S,k,c_1,c_2,\dots ,c_{𝓁})$, where k and the encryption of the ith bit, $c_i$, are computed as

  $$c_i=m_i·\left({\displaystyle \frac{g_i\left(s\right)}{N}}\right)\mathrm{and}k=\left({\displaystyle \frac{\tau \left(s\right)}{N}}\right).$$
• Decrypt$(C,S{K}_{ID},PP)$: Let $R=H\left(ID\right)$.
  • If $R=r^2(modN)$, then solve $E(R,S,N)$ and set $(f_1,g_1)$. Consider $F_1=f_1$ and the ciphertext $C^{\prime }=C$.
  • If $uR=r^2(modN)$, then get the set of polynomials $(f_1,g_1,{\overline{f}}_1,\tau )={\mathcal{Q}}^{\prime }(N,u,R,S)$. Consider $F_1={\overline{f}}_1$ and the ciphertext $C^{\prime }=k·C$.
  Subsequently, the receiver decrypts the first bit by computing

  $$m_1=c_1^{\prime }·\left({\displaystyle \frac{F_1\left(r\right)}{N}}\right).$$
  Then, for each $i\in [2,𝓁]$, consider $M_{i-1}=m_1\left|\right|m_2\left|\right|\dots \left|\right|m_{i-1}$, compute the hash value $L_i=H_1(R,S,M_{i-1})$ and derive the new pair $(x_i,y_i)$ as

  $$\begin{array}{cc}\hfill x_i& ={\displaystyle \frac{S{x}_{i-1}-R{L}_i^2{x}_{i-1}-2S{L}_i{y}_{i-1}}{S+R{L}_i^2}}modN,\hfill \\ \hfill y_i& ={\displaystyle \frac{R{L}_i^2{y}_{i-1}-2R{L}_i{x}_{i-1}-S{y}_{i-1}}{S+R{L}_i^2}}modN.\hfill \end{array}$$
  Let $F_i\left(j\right)=x_{i}j+1$, for $i\in [2,𝓁]$, if $R\in Q{R}_N$. Otherwise, for $i\in [2,𝓁]$, consider $F_i\left(j\right)=1+S{y}_i{\beta }_0+{\alpha }_0{x}_{i}j$. The decryption of the ith bit is

  $$m_i=c_i·\left({\displaystyle \frac{F_i\left(r\right)}{N}}\right).$$

When $𝓁=1$, EffIBE is equivalent to AnonIBE.

3.1. Correctness

The correctness of the proposed method with respect to the decryption of the first bit is an immediate consequence of the results presented in [12].

Message bits $m_2,\dots ,m_{𝓁}$ are obtained through the decryption mechanism presented in Section 3, the correctness argument is derived using Lemma 1 proven in [14].

Lemma 1.

Let $(x,y)\in {\mathbb{Z}}_N^2$ be a solution of Equation (1). Then, for any different solution $(x_0,y_0)$ of Equation (1) such that $\mathrm{g}\mathrm{c}\mathrm{d}(x-x_0,N)=1$, there exists a unique $t\in {\mathbb{Z}}_N$, such that $gcd(N,R+S{t}^2)=1$ which shifts $(x,y)$ to $(x_0,y_0)$ as follows

$$\begin{array}{cc}\hfill x_0& =-{\displaystyle \frac{(R-S{t}^2)x+2Sty}{R+S{t}^2}}modN,\hfill \\ \hfill y_0& ={\displaystyle \frac{-2Rtx+(R-S{t}^2)y}{R+S{t}^2}}modN.\hfill \end{array}$$

Corollary 1.

The relations presented in Lemma 1 and Section 3 are equivalent.

Proof. 

We denote $L=t^{-1}modN$.

$$\begin{array}{cc}\hfill x_0& =-{\displaystyle \frac{(R-S{t}^2)x+2Sty}{R+S{t}^2}}={\displaystyle \frac{S{t}^{2}x-Rx-2Sty}{R+S{t}^2}}\hfill \\ \hfill & ={\displaystyle \frac{t^2(Sx-R{t}^{-2}x-2S{t}^{-1}y)}{t^2(R{t}^{-2}+S)}}={\displaystyle \frac{Sx-R{t}^{-2}x-2S{t}^{-1}y}{R{t}^{-2}+S}}\hfill \\ \hfill & ={\displaystyle \frac{Sx-R{L}^{2}x-2SLy}{R{L}^2+S}};\hfill \\ \hfill y_0& ={\displaystyle \frac{-2Rtx+(R-S{t}^2)y}{R+S{t}^2}}={\displaystyle \frac{Ry-2Rtx-S{t}^{2}y}{R+S{t}^2}}\hfill \\ \hfill & ={\displaystyle \frac{t^2(R{t}^{-2}y-2R{t}^{-1}x-Sy)}{t^2(R{t}^{-2}+S)}}={\displaystyle \frac{R{t}^{-2}y-2R{t}^{-1}x-Sy}{R{t}^{-2}+S}}\hfill \\ \hfill & ={\displaystyle \frac{R{L}^{2}y-2RLx-Sy}{R{L}^2+S}}.\hfill \end{array}$$

□

Therefore, each pair $(x_i,y_i)\in {\mathbb{Z}}_N^2$ obtained during the encryption and decryption processes is a solution of Equation (1), and, thus, the decryption is correctly processed. Hence, the sender and the receiver maintain the synchronization of their parameters.

3.2. Further Analysis

For a fixed secret encryption parameter s and a prime $p\in \mathbb{N}$, we define the following sets:

$$\begin{array}{cc}\hfill P_p^{+}\left(s\right)& =\left\{(x,y)\in {\left({\mathbb{Z}}_p^{\ast }\right)}^2|(x,y)\mathrm{solution}\mathrm{of}Equation (1)\mathrm{and}\left({\displaystyle \frac{2ys+2}{p}}\right)=1\right\},\hfill \\ \hfill P_p^{-}\left(s\right)& =\left\{(x,y)\in {\left({\mathbb{Z}}_p^{\ast }\right)}^2|(x,y)\mathrm{solution}\mathrm{of}Equation (1)\mathrm{and}\left({\displaystyle \frac{2ys+2}{p}}\right)=-1\right\},\hfill \\ \hfill {\mathcal{C}}_p& =P_p^{+}\left(s\right)\cup P_p^{-}\left(s\right).\hfill \end{array}$$

In [14] the authors have proved that ${\displaystyle |{\mathcal{C}}_p| =p-\left(\frac{-1}{p}\right)}$. We study the cardinalities of the sets $P_p^{+}\left(s\right)$ and $P_p^{-}\left(s\right)$ in Lemma 2.

Lemma 2.

The following equality holds ${\displaystyle |P_p^{+}\left(s\right)|= |P_p^{-}\left(s\right)|=\frac{|{\mathcal{C}}_p|}{2}}$.

Proof. 

We will show that $|P_p^{+}\left(s\right)|-|P_p^{-}\left(s\right)|=0$.

$$\begin{array}{cc}\hfill |P_p^{+}\left(s\right)|-|P_p^{-}\left(s\right)|& =\sum _{(x,y)\in P_p^{+}\left(s\right)}\left({\displaystyle \frac{2ys+2}{p}}\right)-\sum _{(x,y)\in P_p^{-}\left(s\right)}\left|\left({\displaystyle \frac{2ys+2}{p}}\right)\right|\hfill \\ \hfill & =\sum _{(x,y)\in P_p^{+}\left(s\right)}\left({\displaystyle \frac{2ys+2}{p}}\right)+\sum _{(x,y)\in P_p^{-}\left(s\right)}\left({\displaystyle \frac{2ys+2}{p}}\right)\hfill \\ \hfill & =\left({\displaystyle \frac{2}{p}}\right)\sum _{(x,y)\in {\mathcal{C}}_p}\left({\displaystyle \frac{ys+1}{p}}\right).\hfill \end{array}$$

To prove the latter sum $\mathcal{S}=0$, we make the following remarks:

• If $(x,y_1)\in {\mathcal{C}}_p$, then $(-x,y_2)\in {\mathcal{C}}_p$ and ${\displaystyle \left(\frac{y_{1}s+1}{p}\right)=\left(\frac{y_{2}s+1}{p}\right)=\pm 1}$, where $y_1=y_2$;
• $(x,y)\in {\mathcal{C}}_p\iff R{x}^2+S{y}^2=1(modp)\iff 1-S{y}^2=R{x}^2(modp)$;
• If $(x,y)\in {\mathcal{C}}_p$ and $R\in Q{R}_p$ (or $R\in QN{R}_p$), then ${\displaystyle \left(\frac{1-S{y}^2}{p}\right)=1}$ (or $-1$);
• ${\displaystyle \sum _{t\in {\mathbb{Z}}_p}\left(\frac{t}{p}\right)=0}$.

Consequently, when $R\in Q{R}_p$, it follows that

$$\begin{array}{cc}\hfill \mathcal{S}& =\sum _{(x,y)\in {\mathcal{C}}_p}\left({\displaystyle \frac{ys+1}{p}}\right)=\sum _{y\in {\mathbb{Z}}_p}\left(1+\left({\displaystyle \frac{1-S{y}^2}{p}}\right)\right)·\left({\displaystyle \frac{ys+1}{p}}\right)\hfill \\ \hfill & =\left(\sum _{y\in {\mathbb{Z}}_p}\left({\displaystyle \frac{ys+1}{p}}\right)\right)+\left(\sum _{y\in {\mathbb{Z}}_p}\left({\displaystyle \frac{1-S{y}^2}{p}}\right)\left({\displaystyle \frac{ys+1}{p}}\right)\right)\hfill \\ \hfill & =\left(\sum _{t\in {\mathbb{Z}}_p}\left({\displaystyle \frac{t}{p}}\right)\right)+\left(\sum _{y\in {\mathbb{Z}}_p}\left({\displaystyle \frac{1-ys}{p}}\right)·{\left({\displaystyle \frac{ys+1}{p}}\right)}^2\right)\hfill \\ \hfill & =0+\left(\sum _{t\in {\mathbb{Z}}_p}\left({\displaystyle \frac{t}{p}}\right)·1\right)=0.\hfill \end{array}$$

If $R\in QN{R}_p$, then $\mathcal{S}=0$, as it admits the equivalent representation

$${\displaystyle \mathcal{S}=\sum _{y\in {\mathbb{Z}}_p}\left(1-\left(\frac{1-S{y}^2}{p}\right)\right)·\left(\frac{ys+1}{p}\right).}$$

Since $P_p^{+}\left(s\right)\cap P_p^{-}\left(s\right)=⌀,P_p^{+}\left(s\right)\cup P_p^{-}\left(s\right)={\mathcal{C}}_p$ and $|P_p^{+}\left(s\right)|=|P_p^{-}\left(s\right)|$, we obtain our result. □

Corollary 2.

For an RSA-modulus $N\in \mathbb{N},N=pq$, the following equality holds

$${\displaystyle |P_N^{+}\left(s\right)|= |P_N^{-}\left(s\right)|=\frac{|{\mathcal{C}}_N|}{2}.}$$

Proof. 

By the definition of the Jacobi symbol, we obtain the following identities

$$\begin{array}{cc}\hfill P_N^{+}\left(s\right)& =(P_p^{+}\left(s\right)\times P_q^{+}\left(s\right))\cup (P_p^{-}\left(s\right)\times P_q^{-}\left(s\right)),\hfill \\ \hfill P_N^{-}\left(s\right)& =(P_p^{+}\left(s\right)\times P_q^{-}\left(s\right))\cup (P_p^{-}\left(s\right)\times P_q^{+}\left(s\right)).\hfill \end{array}$$

According to Lemma 2 and the Chinese Remainder Theorem (CRT), we obtain our result. □

Lemma 3.

Let $(x_0,y_0)\in P_p^{+}\left(s\right)$, $(x_1,y_1)\in {\mathcal{C}}_p$ and $L\in {\mathbb{Z}}_p$, such that $S+R{L}^2\ne 0(modp)$, which shifts $(x_0,y_0)$ to $(x_1,y_1)$ as presented in Section 3. Then

$$\begin{array}{cc}\hfill P\left((x_1,y_1)\in P_p^{+}\left(s\right)\right)& ={\displaystyle \frac{1}{2}}-\mathcal{O}\left({\displaystyle \frac{1}{p}}\right),\hfill \\ \hfill P\left((x_1,y_1)\in P_p^{-}\left(s\right)\right)& ={\displaystyle \frac{1}{2}}+\mathcal{O}\left({\displaystyle \frac{1}{p}}\right).\hfill \end{array}$$

Proof. 

A condition required to complete the shift from $(x_0,y_0)$ to $(x_1,y_1)$ presented in Lemma 1 is $x_0\ne x_1(modp)$.

Thus, only one of the following relations is true

$$\begin{array}{cc}\hfill (x_1,y_1)& \in \left(P_p^{+}\left(s\right)\setminus \{(x_0,y_0),(x_0,-y_0)\}\right)\cup P_p^{-}\left(s\right),\hfill \\ \hfill (x_1,y_1)& \in \left(P_p^{+}\left(s\right)\setminus \left\{(x_0,y_0)\right\}\right)\cup \left(P_p^{-}\left(s\right)\setminus \left\{(x_0,-y_0)\right\}\right).\hfill \end{array}$$

Therefore, using Lemma 2, we have the following

$$\begin{array}{cc}\hfill P\left((x_1,y_1)\in P_p^{+}\left(s\right)\right)& =\left\{\begin{array}{cc}{\displaystyle \frac{|P_p^{+}\left(s\right)|-2}{|{\mathcal{C}}_p|-2}=\frac{1}{2}-\mathcal{O}\left(\frac{1}{p}\right)}\hfill & ,\mathrm{if}(x_0,-y_0)\in P_p^{+}\left(s\right);\hfill \\ {\displaystyle \frac{|P_p^{+}\left(s\right)|-1}{|{\mathcal{C}}_p|-2}=\frac{1}{2}}\hfill & ,\mathrm{if}(x_0,-y_0)\in P_p^{-}\left(s\right);\hfill \end{array}\right.\hfill \\ \hfill P\left((x_1,y_1)\in P_p^{-}\left(s\right)\right)& =\left\{\begin{array}{cc}{\displaystyle \frac{|P_p^{+}\left(s\right)|}{|{\mathcal{C}}_p|-2}=\frac{1}{2}+\mathcal{O}\left(\frac{1}{p}\right)}\hfill & ,\mathrm{if}(x_0,-y_0)\in P_p^{+}\left(s\right);\hfill \\ {\displaystyle \frac{|P_p^{+}\left(s\right)|-1}{|{\mathcal{C}}_p|-2}=\frac{1}{2}}\hfill & ,\mathrm{if}(x_0,-y_0)\in P_p^{-}\left(s\right).\hfill \end{array}\right.\hfill \end{array}$$

□

Lemma 4.

Let $(x_0,y_0)\in P_p^{-}\left(s\right)$, $(x_1,y_1)\in {\mathcal{C}}_p$ and $L\in {\mathbb{Z}}_p$, such that $S+R{L}^2\ne 0(modp)$, which shifts $(x_0,y_0)$ to $(x_1,y_1)$ as presented in Section 3. Then

$$\begin{array}{cc}\hfill P\left((x_1,y_1)\in P_p^{+}\left(s\right)\right)& ={\displaystyle \frac{1}{2}}+\mathcal{O}\left({\displaystyle \frac{1}{p}}\right),\hfill \\ \hfill P\left((x_1,y_1)\in P_p^{-}\left(s\right)\right)& ={\displaystyle \frac{1}{2}}-\mathcal{O}\left({\displaystyle \frac{1}{p}}\right).\hfill \end{array}$$

Proof. 

The argument is similar to the one shown in Lemma 3. □

Corollary 3.

Let $(x_0,y_0)\in P_N^{+}\left(s\right)$ (or $P_N^{-}\left(s\right)$), $(x_1,y_1)\in {\mathcal{C}}_N$ and $L\in {\mathbb{Z}}_N$ such that $\mathrm{g}\mathrm{c}\mathrm{d}(N,S+R{L}^2)=1$, which shifts $(x_0,y_0)$ to $(x_1,y_1)$ as presented in Section 3. Then the following identities hold

$$\begin{array}{cc}\hfill P\left((x_1,y_1)\in P_N^{+}\left(s\right)\right)& \approx {\displaystyle \frac{1}{2}}\pm \mathcal{O}\left({\displaystyle \frac{1}{2^{\lambda }}}\right),\hfill \\ \hfill P\left((x_1,y_1)\in P_N^{-}\left(s\right)\right)& \approx {\displaystyle \frac{1}{2}}\mp \mathcal{O}\left({\displaystyle \frac{1}{2^{\lambda }}}\right).\hfill \end{array}$$

Proof. 

According to the identities presented in Corollary 2 and the results from Lemma 3, Lemma 4 we obtain our conclusion. □

4. Security & Anonymity

In [12] the authors stated that BasicIBE does not provide anonymity to the receiver. Therefore, they introduced a new, more complex scheme, AnonIBE, which offers an anonymization process. During the proof of the ANON-IND-ID-CPA property of AnonIBE, they utilized Lemma 5 (Lemma 3.3 in [12]).

Lemma 5.

Let $N=pq$ be an RSA modulus, $X\in Q{R}_N,S\in J_N\setminus Q{R}_N$. Let $x\leftarrow \{x_1,x_2,x_3,x_4\}$, where $x_i^2=X(modN)$ are the four square roots of X modulo N and consider a polynomial f that satisfies condition 2 presented in Section 2.3. Then $\left({\displaystyle \frac{f\left(x\right)}{N}}\right)$ is uniformly distributed in $\{-1,1\}$.

We will prove that our scheme is ANON-IND-ID-CPA secure based on IQR assumption. During the proof of the following theorem, we will use pseudorandom functions (PRFs) as they are introduced in [19].

Theorem 1.

If $\mathcal{A}$ is an efficient ANON-IND-ID-CPA adversary against  EffIBE, then there exist three independent and efficient algorithms ${\mathcal{B}}_1,{\mathcal{B}}_2,{\mathcal{B}}_3$ running in about the same time as adversary $\mathcal{A}$, such that

$$\begin{array}{cc}\hfill IBEAd{v}_{\mathcal{A},\mathrm{E}\mathrm{F}\mathrm{F}\mathrm{I}\mathrm{B}\mathrm{E}}\left(\lambda \right)& \le PRFAd{v}_{{\mathcal{B}}_1,F}\left(\lambda \right)+(𝓁-1)PRFAd{v}_{{\mathcal{B}}_2,H_1}\left(\lambda \right)\hfill \\ \hfill & + IQRAd{v}_{{\mathcal{B}}_3,(RSAgen,H)}\left(\lambda \right).\hfill \end{array}$$

Proof. 

The proof will be completed using a series of games. We will denote by $G_i$ and $G_{i.j}$ the events of winning the ith game and, respectively, the jth subgame of the ith game.

G0: 

This game follows exactly the steps presented in Definition 1, thus

$$\begin{array}{c}\hfill \left|Pr\left[G_0\right]-{\displaystyle \frac{1}{2}}\right|=IBEAd{v}_{\mathcal{A},\mathrm{E}\mathrm{F}\mathrm{F}\mathrm{I}\mathrm{B}\mathrm{E}}\left(\lambda \right).\end{array}$$

(2)

G1: 

During the private key query, the challenger uses a truly random function $f:\mathcal{ID}\to {\mathbb{Z}}_4$ instead of a secure PRF $F_k$ in order to choose which private key $r\in \{r_0,r_1,r_2,r_3\}$ to be sent to the adversary. Under these conditions, the adversary $\mathcal{A}$ will not notice any difference between Game 0 and Game 1; therefore, there exists an algorithm ${\mathcal{B}}_1$ (running in similar time as the adversary) such that

$$\begin{array}{c}\hfill |Pr\left[G_1\right]-Pr\left[G_0\right]|={\mathrm{PRFAdv}}_{{\mathcal{B}}_1,F}\left(\gamma \right).\end{array}$$

(3)

G2: 

Within this game, the challenger has access to a modular square root oracle $\mathcal{O}$, which is selected uniformly random from the set of all possible such oracles. When given as input $(N,u,H,ID)$, it returns a random private key r without having access to the factorization of N. Therefore, this game is placed in the context of the IQR assumption. Moreover, the distributions of the answers to adversary queries are identical to those observed in the previous game. Thus, the following identity holds

$$\begin{array}{c}\hfill Pr\left[G_2\right]=Pr\left[G_1\right].\end{array}$$

(4)

G3: 

This game will be built using the following $𝓁-1$ subgames.

  G3.1: 

In the course of this game, the encryption query is changed from the one in Game 2 when computing the last ciphertext bit $c_{𝓁}$. Instead of generating $L_{𝓁}$ as in Section 3 using the hash function $H_1$, we generate it using a different PRF T and compute the ciphertext bit using the same method. Therefore, there exists an efficient algorithm ${\mathcal{B}}_2$ that runs similarly in time as $\mathcal{A}$ such that

$$\begin{array}{c}\hfill |Pr\left[G_{3.1}\right]-Pr\left[G_2\right]|\le PRFAd{v}_{B_2,H_1}\left(\lambda \right).\end{array}$$

(5)

  G3.2: 

This game proceeds as subgame 3.1, the difference between them being the encryption process of the last two bits $m_{𝓁-1},m_{𝓁}$ instead of only the latter. The challenger generates both $L_{𝓁-1},L_{𝓁}$ using the different PRF T instead of computing them using $H_1$. Therefore, similarly, the following inequality holds

$$\begin{array}{c}\hfill |Pr\left[G_{3.2}\right]-Pr\left[G_{3.1}\right]|\le PRFAd{v}_{B_2,H_1}\left(\lambda \right).\end{array}$$

(6)

Hence, using Equations (5) and (6), we have that

$$\begin{array}{cc}\hfill |Pr\left[G_{3.2}\right]-Pr\left[G_2\right]|& \le |Pr\left[G_{3.2}\right]-Pr\left[G_{3.1}\right]|+|Pr\left[G_{3.1}\right]-Pr\left[G_2\right]|\hfill \\ \hfill & \le 2·PRFAd{v}_{B_2,H_1}\left(\lambda \right)\hfill \end{array}$$

• ⋮

  G3.($𝓁-1$):

This subgame progresses similarly as subgame $G3.(𝓁-2)$; the challenger computes values $L_2,\dots ,L_{𝓁}$ utilizing T and encrypts bits $m_2,\dots ,m_{𝓁}$ accordingly. Thus, the following inequality holds

$$\left|Pr\right[G_{3.(𝓁-1)}]-Pr[G_{3.(𝓁-2)}\left]\right|\le PRFAd{v}_{B_2,H_1}\left(\lambda \right)$$

Therefore, we have the following inequality

$$\begin{array}{cc}\hfill \left|Pr\right[G_{3.(𝓁-1)}]-Pr\left[G_2\right]|& \le {\displaystyle \sum _{k=2}^{𝓁-1}}|Pr\left[G_{3.k}\right]-Pr\left[G_{3.(k-1)}\right]|+|Pr\left[G_{3.1}\right]-Pr\left[G_2\right]|\hfill \\ \hfill & \le (𝓁-1)·PRFAd{v}_{B_2,H_1}\left(\lambda \right).\hfill \end{array}$$

(7)

G4: 

The game is set almost identically to the subgame $G3.(𝓁-1)$, the only difference consists in the generation process of S; that is, instead of generating it $S\stackrel{\$}{\leftarrow }Q{R}_N$, the Challenger chooses randomly $S\stackrel{\$}{\leftarrow }{J}_N\setminus Q{R}_N$. Hence, Game 4 is indistinguishable from Game 3 under the IQR assumption. More precisely, there exists an algorithm ${\mathcal{B}}_3$ whose running time is comparable to that of $\mathcal{A}$ such

$$|Pr\left[G_4\right]-Pr\left[G_{3.(𝓁-1)}\right]|\le IQRAd{v}_{{\mathcal{B}}_3,(RSAgen,H)}\left(\lambda \right).$$

(8)

In order to show that $\mathcal{A}$ wins Game 4 exactly half of the time, we argue that the ciphertext $(S,k,c_1,\dots ,c_{𝓁})$ is independent of the random bit b. Corollary 3 implies the sets $P_N^{+}\left(s\right)$ and $P_N^{-}\left(s\right)$ have identical distributions when $S\in Q{R}_N$ and Lemma 5 ensures that each ciphertext bit $c_i$ is uniform in $\{-1,1\}$ when $S\in J_N\setminus Q{R}_N$.

Therefore, Equations (2)–(4), (7) and (8) implies that

$$\begin{array}{cc}\hfill IBEAd{v}_{\mathcal{A},\mathrm{E}\mathrm{F}\mathrm{F}\mathrm{I}\mathrm{B}\mathrm{E}}\left(\lambda \right)& \le PRFAd{v}_{{\mathcal{B}}_1,F}\left(\lambda \right)+(𝓁-1)PRFAd{v}_{{\mathcal{B}}_2,H_1}\left(\lambda \right)\hfill \\ \hfill & + IQRAd{v}_{{\mathcal{B}}_3,(RSAgen,H)}\left(\lambda \right).\hfill \end{array}$$

□

Comparison

In Table 2 we present a comparison between the two schemes presented in [12] (BasicIBE, AnonIBE) and our proposed scheme EffIBE. The differences between them are considered in the context of an 𝓁-bit processed plaintext with a $2\lambda$-bit N. We compare the plaintext-to-ciphertext bit expansions, the computational complexities of the encryption and decryption processes with respect to the number of times Equation (1) is solved via Remark 1 and whether the scheme provides anonymity to the receiver.

Table 2. Schemes’ Comparisons.

	BasicIBE	AnonIBE	EffIBE
Expansion	$2\lambda +2𝓁$	$2\lambda +𝓁+1$	$2\lambda +𝓁+1$
Private Key Size	$2\lambda 𝓁$	$2\lambda 𝓁$	$2\lambda$
Enc. Complexity	$2𝓁\mathcal{O}\left({\lambda }^4\right)$	$(𝓁+1)\mathcal{O}\left({\lambda }^4\right)$	$2\mathcal{O}\left({\lambda }^4\right)$
Dec. Complexity	$𝓁\mathcal{O}\left({\lambda }^4\right)$	$(𝓁+1)\mathcal{O}\left({\lambda }^4\right)$	$\mathcal{O}\left({\lambda }^4\right)$ or $2\mathcal{O}\left({\lambda }^4\right)$
Anonymity	✗	✓	✓

5. Conclusions

In this paper, we introduced a new, more efficient BGH-like cryptosystem. Our proposed scheme reduces the complexity of both the encryption and decryption algorithms and offers anonymity to the receiver by design. Supplementary, we continued the work of Jhanwar and Barua [14] and took an in-depth look at the solutions sets of Equation (1) in the setup of the Boneh–Gentry–Hamburg cryptosystem and compared the distributions of these sets.