On the Anonymity of Identity-Based Encryption

Abstract

Anonymity of identity-based encryption (IBE) means that given a ciphertext, one cannot distinguish the target identity from a random identity. In this paper, we thoroughly discuss the anonymity of IBE systems. We found that the current definition of anonymity is obscure to describe some IBE systems, such as Gentry IBE system. Furthermore, current definition cannot express the degree of anonymity. So we divide the degree of anonymity into weak anonymity and strong anonymity based on indistinguishability between different games. For weakly anonymous IBE systems, the target identity in a ciphertext cannot be distinguished from a random identity. For strongly anonymous IBE systems, the whole ciphertext cannot be distinguished from a random tuple. We also discuss the type of anonymity and divide it into two types. Type 1 means that a random tuple can be seen as a valid ciphertext, while type 2 cannot. Based on our new definitions, we show that three famous IBE systems, Gentry IBE system, Boyen-Waters IBE system, and Lewko IBE system, have strong but different types of anonymity.

1. Introduction

Shamir [1] proposed the concept of identity-based encryption (IBE) in 1984 to simplify the public key infrastructure. In an IBE system, public keys for users can be formed from arbitrary strings such as e-mail addresses, IP addresses, or other meaningful strings. Anyone can encrypt messages using the identity, and only the owner of the corresponding secret key can decrypt the messages. But Shamir did not give a concrete construction of IBE until Boneh and Franklin [2] presented the first practical IBE system based on groups with efficiently computable bilinear maps. Another but less efficient IBE system using quadratic residues was proposed by Cocks [3]. After that, many new IBE systems are proposed [4–11].

Anonymous IBE was first noticed by Boyen [12] and later formalized by Abdalla et al. [13, 14]. Roughly speaking, an IBE system is said to be recipient anonymous or simply anonymous if the ciphertext leaks no information about the recipient’s identity. In other words, an attack cannot distinguish the target identity from a random identity for a ciphertext. Recently, people found that the anonymity of IBE can help to construct public key encryption with keyword search (PEKS) systems [13, 15–17].

The first anonymous IBE system is Boneh-Franklin IBE system [2]. In fact, this system has intrinsic anonymity; that is, its semantic security equals anonymity. But Boneh-Franklin IBE system is proposed in the random oracle model [18]. Boyen and Waters [8] gave the first construction of anonymous IBE in the standard model under the decisional bilinear Diffie-Hellman (BDH) and decisional linear assumptions. Another efficient construction of anonymous IBE in the standard model was proposed by Gentry [9], but it is proven secure under a dynamic and complicates assumption. After that, many new anonymous IBE systems in the standard model are proposed [19–21]. An extension of anonymous IBE, named committed blind anonymous IBE, was proposed by Camenisch et al. [22] in which a user can request the decryption key for a given identity without the key generation entity learning the identity.

When studying how to construct anonymous IBE systems, researchers have found if asymmetric bilinear maps are used in previous IBE systems [4–7]; these systems seem anonymous. But how to prove anonymous security of these systems from simple assumptions was unknown until Ducas [23] gave a positive answer. He showed that an IBE system can be proven anonymous with some minor modification. Another anonymous IBE system using asymmetric bilinear map is proposed by Chen et al. [24]. Recently, Herranz et al. [25] discussed the relations between semantic security and anonymity for IBE systems.

When an “anonymous” IBE system is constructed, we should prove its anonymity. It seems to prove anonymity for IBE systems, we only need to prove that we cannot distinguish the target identity from the challenge ciphertext in the security game for anonymity. However, current anonymous IBE systems, except Gentry IBE system [9], all use a stronger game called Game_Random than the standard game for anonymity where the challenge ciphertext is composed of independently random group elements to prove anonymity. Obviously, if a valid ciphertext is indistinguishable from a random tuple, it is definitely anonymous. However, the game Game_Random is overqualified for anonymity, because anonymity only requires that an attacker cannot distinguish the target identity for a ciphertext. Hence, current definition of anonymity is not complete enough to describe the anonymity of current IBE systems.

Our Results. We make a concrete analysis of the anonymity of identity-based encryption systems. We found that current definition of anonymity is obscure to describe some IBE systems, such as Gentry IBE system [9]. Furthermore, current definition cannot express the degree of anonymity. By using the indistinguishability of some related security games, we divide anonymity into two degrees: weak anonymity and strong anonymity. Weak anonymity equals current definition of anonymity, in which the target identity for a ciphertext cannot be distinguished from a random identity. For strongly anonymous IBE systems, the whole ciphertext cannot be distinguished from a random tuple. We also discuss the type of anonymity and divide it into two types. Type 1 means that a random tuple can be seen as a valid ciphertext for some identity, while type 2 cannot. Based on our discussion, we analyse some IBE systems. We show that three famous IBE systems, Gentry IBE System [9], Boyen-Waters IBE system [8], and Lewko IBE System [26], have strong but different types of anonymity.

Organization. The paper is organized as follows. We give necessary background information and definitions of security in Section 2. We then analyse the anonymity and define different degrees and types of anonymity in Section 3. In Section 4, we discuss the anonymity of some current IBE systems. At last we conclude the paper with Section 5.

2. Background

In this section, we briefly review the concepts of the bilinear maps, identity-based encryption, and its security models for semantic security and anonymity.

2.1. Bilinear Maps

Definition 1. Let 𝔾, 𝔾_𝑇 be two cyclic multiplicative groups with prime order 𝑝. Let 𝑔 be a generator of 𝔾 and 𝑒∶𝔾×𝔾→𝔾_𝑇 a bilinear map with the following properties:(1)bilinearity: for all 𝑢,𝑣∈𝔾 and for all 𝑎,𝑏∈ℤ, one has 𝑒(𝑢^𝑎,𝑣^𝑏)=𝑒(𝑢,𝑣)^𝑎𝑏;(2)nondegeneracy: the map does not send all pairs in 𝔾×𝔾 to the identity in 𝔾_𝑇. Observe that since 𝔾,𝔾_𝑇 are groups of prime order, this implies that if 𝑔 is a generator of 𝔾 then 𝑒(𝑔,𝑔) is a generator of 𝔾_𝑇.
We say that 𝔾 is a bilinear group if the group operation in 𝔾 and the bilinear map 𝑒∶𝔾×𝔾→𝔾_𝑇 are both efficiently computable.

Bilinear maps are also called pairings. We assume that there is an efficient algorithm 𝒢 for generating bilinear groups. The algorithm 𝒢, on input a security parameter 𝜆, outputs a tuple 𝐺=[𝑝,𝔾,𝔾₁,𝑔∈𝔾,𝑒], where 𝑔 is a generator and log(𝑝)=Θ(𝜆).

2.2. Algorithms

An IBE system consists of the following four algorithms: Setup, KeyGen, Encrypt, and Decrypt.

Setup(1^λ). This algorithm takes as input the security parameter 𝜆 and outputs a public key PK and a master secret key MK. The public key implies also a key space 𝒦(PK) and an identity space ℐ𝒟(PK).

KeyGen(MK, ℐ). This algorithm takes as input the master secret key MK and an identity ℐ∈ℐ𝒟(PK) and outputs a secret key SK_ℐ associated with ℐ.

Encrypt(PK, ℐ, M). This algorithm takes as input the public key PK, an identity ℐ, and a message 𝑀 and outputs a ciphertext CT.

Decrypt(SK_ℐ, CT). This algorithm takes as input a secret key SK_ℐ and the ciphertext CT. If the ciphertext is an encryption to ℐ, then the algorithm outputs the encrypted message 𝑀.

2.3. Security Models

The chosen plaintext security (semantic security) and anonymity of an IBE system are defined according to the following IND-ID-CPA (indistinguishability against full identity and chosen plaintext attacks) game and ANON-ID-CPA (anonymity against full identity and chosen plaintext attacks) game, respectively.

IND-ID-CPA Game

Setup. The challenger ℬ runs the Setup algorithm and gives PK to the adversary 𝒜.

Phase 1. The adversary 𝒜 submits an identity ℐ. The challenger creates a secret key SK_ℐ for that identity and gives it to the adversary.

Challenge. 𝒜 submits a challenge identity ℐ^∗ and two equal length messages 𝑀₀,𝑀₁ to ℬ with the restriction that each identity ℐ given out in the key phase must not be ℐ^∗. Then ℬ flips a random coin 𝛽∈{0,1} and passes the ciphertext CT^∗= Encrypt(PK,𝑀_𝛽,ℐ^∗) to 𝒜.

Phase 2. Phase 1 is repeated with the restriction that any queried identity ℐ is not ℐ^∗.

Guess. 𝒜 outputs its guess 𝛽^′ of 𝛽.

The advantage of 𝒜 in this game is defined as Adv_𝒜=|Pr[𝛽^′=𝛽]−(1/2)|.

Definition 2. One says that an IBE system is IND-ID-CPA secure, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in winning the IND-ID-CPA game.

ANON-ID-CPA  Game

Setup. The challenger ℬ runs the Setup algorithm and gives PK to the adversary 𝒜.

Phase 1. The adversary 𝒜 submits an identity ℐ. The challenger creates a secret key SK_ℐ for that identity and gives it to the adversary.

Challenge. 𝒜 submits two challenge identities ℐ^∗₀,ℐ^∗₁ and a message 𝑀 to ℬ with the restriction that each identity ℐ given out in the key phase must not be ℐ^∗₀ or ℐ^∗₁. Then ℬ flips a random coin 𝜇∈{0,1} and passes the ciphertext CT^∗=Encrypt(PK,𝑀,ℐ^∗_𝜇) to 𝒜.

Phase 2. Phase 1 is repeated with the restriction that any queried identity ℐ is not ℐ^∗₀ or ℐ^∗₁.

Guess. 𝒜 outputs its guess 𝜇^′ of 𝜇.

The advantage of 𝒜 in this game is defined as Adv_𝒜=|Pr[𝜇^′=𝜇]−(1/2)|.

Definition 3. One says that an IBE system is ANON-ID-CPA secure, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in winning the ANON-ID-CPA game.

Some systems such as [8, 27] use weaker notions called IND-sID-CPA (indistinguishability against selective identity and chosen plaintext attacks) security and ANON-sID-CPA (anonymity against selective identity and chosen plaintext attacks) security, which are against selective identity. In the selective identity models, the adversary submits the target identity ℐ^∗ (or ℐ^∗₁, ℐ^∗₂) before public parameters are generated.

3. Analysis of Anonymity

Most IBE systems are constructed on bilinear maps. However, it is hard to construct anonymous IBE systems due to the bilinearity of bilinear maps, that is, for all 𝑢,𝑣∈𝔾 and for all 𝑎,𝑏∈ℤ_𝑝, we have 𝑒(𝑢^𝑎,𝑣^𝑏)=𝑒(𝑢^𝑏,𝑣^𝑎). For pairing-based IBE systems, it is easy for us to test the target identity if an IBE system is not anonymous. Roughly speaking, if an IBE system is not anonymous, supposing that 𝐶₁,…,𝐶_𝑘∈𝔾 are components of a ciphertext of such a system, we can construct elements 𝑎₁,…,𝑎_𝑘∈𝔾 from the public parameters and some identity ℐ to check whether 𝑒(𝐶₁,𝑎₁)⋯𝑒(𝐶_𝑘,𝑎_𝑘)=1, where 𝑒∶𝔾×𝔾→𝔾_𝑇 denotes the bilinear map used in the system. If the equation is true, the target identity is ℐ. Using this method, we can easily see that some previous IBE systems are not anonymous, such as [4–7, 10, 11].

Gentry proposed the concept of ANON-IND-ID-CPA (anonymity and indistinguishability against full identity and chosen plaintext attacks) security in [9] which is the conjunction of IND-ID-CPA security and ANON-ID-CPA security. It seems that Gentry’s definition is equivalent to IND-ID-CPA security and ANON-ID-CPA security, but there is a flaw which makes them not equivalent. To make up this flaw in Gentry’s definition, we first review Gentry’s definition and rewrite these definitions using the indistinguishability between some similar security games.

ANON-IND-ID-CPA  Game

Setup. The challenger ℬ runs the Setup algorithm and gives PK to the adversary 𝒜.

Phase 1. The adversary 𝒜 submits an identity ℐ. The challenger creates a secret key SK_ℐ for that identity and gives it to the adversary.

Challenge. 𝒜 submits two challenge identities ℐ^∗₀,ℐ^∗₁ and two equal length message 𝑀₀,𝑀₁ to ℬ with the restriction that each identity ℐ given out in the key phase must not be ℐ^∗₀ or ℐ^∗₁. Then ℬ picks two random bits 𝛽,𝜇∈{0,1} and passes the ciphertext CT^∗=Encrypt(PK,𝑀_𝛽,ℐ^∗_𝜇) to 𝒜.

Phase 2. Phase 1 is repeated with the restriction that any queried identity ℐ is not ℐ^∗₀ or ℐ^∗₁.

Guess. 𝒜 outputs its guess 𝛽^′ of 𝛽 and 𝜇^′ of 𝜇.

The advantage of 𝒜 in this game is defined as Adv_𝒜=|Pr[𝛽^′=𝛽∧𝜇^′=𝜇]−(1/4)|.

Definition 4. One says that an IBE system is ANON-IND-ID-CPA secure, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in winning the ANON-IND-ID-CPA game.

Though the ANON-IND-ID-CPA game is the conjunction of the IND-ID-CPA game and the ANON-ID-CPA game, they are not always equivalent. If the assumption used in the IND-ID-CPA game is different from the assumption used in the ANON-ID-CPA game, these two games cannot be combined to be the ANON-IND-ID-CPA game. In Gentry’s definition, they are equivalent because only one assumption called the Decision 𝑞-ABDHE assumption is used in these games.

To cover the difference caused by different assumptions and full or selective security, we focus on the core of these games. In the IND-ID-CPA game, the adversary needs to distinguish an encryption of the chosen message from an encryption of a random message both for the challenge identity, while in the ANON-ID-CPA game, the adversary needs to distinguish an encryption for the challenge identity from an encryption for a random identity both of the chosen message. And in the combined ANON-IND-ID-CPA game, the adversary needs to distinguish an encryption of the chosen message for the challenge identity from an encryption of a random message for a random identity. Hence, we can redefine these concepts using the indistinguishability between different challenge ciphertexts.

Let 𝑀 be a message and ℐ^∗ a challenge identity both chosen by the adversary. Let 𝑀_𝑅 be a random message and ℐ_𝑅 a random identity. We define the following games which differ on what challenge ciphertext is given by the simulator to the adversary.(i)Game_𝑀,ℐ^∗: it is the basic game. The challenger runs the Setup algorithm and gives the public key to the adversary. The adversary can make a secret key query for ℐ, where ℐ is not equal to the target identity ℐ^∗. The challenge ciphertext is Encrypt(PK,𝑀,ℐ^∗).(ii)Game_𝑀𝑅,ℐ^∗: this is like Game_𝑀,ℐ^∗ except that the challenge ciphertext is Encrypt(PK,𝑀_𝑅,ℐ^∗).(iii)Game_𝑀,ℐ𝑅: this is like Game_𝑀,ℐ^∗ except that the challenge ciphertext is Encrypt(PK,𝑀,ℐ_𝑅).(iv)Game_{𝑀𝑅,ℐ𝑅}: this is like Game_𝑀,ℐ^∗ except that the challenge ciphertext is Encrypt(PK,𝑀_𝑅,ℐ_𝑅).

Using the indistinguishability between these games, we rewrite the definitions of ANON-IND-ID-CPA, IND-ID-CPA, and ANON-ID-CPA securities as follows.

Definition 5. One says that an IBE system is ANON-IND-ID-CPA secure, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in distinguishing between Game_𝑀,ℐ^∗ and Game_{𝑀𝑅,ℐ𝑅}.

Definition 6. One says that an IBE system is IND-ID-CPA secure, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in distinguishing between Game_𝑀,ℐ^∗ and Game_𝑀𝑅,ℐ^∗.

Definition 7. One says that an IBE system is ANON-ID-CPA secure, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in distinguishing between Game_𝑀,ℐ^∗ and Game_𝑀,ℐ𝑅.

Definitions for selective identity are similar except that in all the games the adversary should submit the target identity ℐ^∗ before public parameters are generated. Note that Game_𝑀𝑅,ℐ^∗, Game_𝑀,ℐ𝑅, and Game_{𝑀𝑅,ℐ𝑅} are three different games. We have the following result for the relation between ANON-IND-ID-CPA security, IND-ID-CPA security, and ANON-ID-CPA security.

Lemma 8. If an IBE system ℰ is IND-ID-CPA secure and ANON-ID-CPA secure, then ℰ is ANON-IND-ID-CPA secure.

Proof. We have Game_𝑀,ℐ^∗Adv_𝒜−Game_𝑀𝑅,ℐ^∗Adv_𝒜≤𝜖₁,Game_𝑀𝑅,ℐ^∗Adv_𝒜−Game_{𝑀𝑅,ℐ𝑅}Adv_𝒜≤𝜖₂, (1)(2) where 𝜖₁,𝜖₂ are both negligible. Equation (1) holds because ℰ is IND-ID-CPA secure and (2) holds because ℰ is ANON-ID-CPA secure. So Game_𝑀,ℐ^∗Adv_𝒜−Game_{𝑀𝑅,ℐ𝑅}Adv_𝒜≤𝜖₁+𝜖₂, (3) which means that ℰ is ANON-IND-ID-CPA secure.

However, it is still unknown whether ANON-IND-ID-CPA security is equivalent to IND-ID-CPA security and ANON-ID-CPA security. The following lemma is an efficient method to prove the anonymity, which is used for some previous systems, such as Caro-Iovino-Persiano HIBE system [28], Seo-Cheon HIBE system [29].

Lemma 9. If an IBE system ℰ is IND-ID-CPA secure, and there is no polynomial time adversary who can distinguish between 𝐺𝑎𝑚𝑒_𝑀𝑅,ℐ^∗ and 𝐺𝑎𝑚𝑒_{𝑀𝑅,ℐ𝑅} with nonnegligible advantage, then ℰ is ANON-ID-CPA secure.

Proof. We have Game_𝑀,ℐ^∗Adv_𝒜−Game_𝑀𝑅,ℐ^∗Adv_𝒜≤𝜖₁,Game_𝑀,ℐ𝑅Adv_𝒜−Game_{𝑀𝑅,ℐ𝑅}Adv_𝒜≤𝜖₂,Game_𝑀𝑅,ℐ^∗Adv_𝒜−Game_{𝑀𝑅,ℐ𝑅}Adv_𝒜≤𝜖₃, (4)(5)(6) where 𝜖₁,𝜖₂,𝜖₃ are all negligible. Equations (4) and (5) hold because ℰ is IND-ID-CPA secure and (6) holds according to the hypothesis. So Game_𝑀,ℐ^∗Adv_𝒜−Game_𝑀,ℐ𝑅Adv_𝒜≤𝜖₁+𝜖₂+𝜖₃, (7) which means that ℰ is ANON-ID-CPA secure.

In some anonymous IBE systems, such as Boyen-Waters anonymous IBE system, they use a new game called Game_Random. We define it as follows.(i)Game_Random: this is like Game_𝑀,ℐ^∗ except that the challenge ciphertext consists of independent random group elements.

Note that Game_Random is different from Game_{𝑀𝑅,ℐ𝑅}. Though they are similar concepts, they are not always equivalent. Game_Random is a special game in which the challenge ciphertext is composed of independent random group elements, while the challenge ciphertext of Game_{𝑀𝑅,ℐ𝑅} is still a valid ciphertext. Since every element is random, the ciphertext leaks no information about the identity. So if the transition from Game_𝑀,ℐ^∗ to Game_Random is computationally indistinguishable, the IBE system is no doubt anonymous. This proof method was used in Boyen-Waters anonymous IBE system and later anonymous IBE systems. Obviously, the transition from Game_𝑀,ℐ^∗ to Game_𝑀,ℐ𝑅 is different from the transition from Game_𝑀,ℐ^∗ to Game_Random. The difference leads to the following classification of anonymous IBE systems.

Definition 10 (weak anonymity). One says that an IBE system has weak anonymity, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in distinguishing between Game_𝑀,ℐ^∗ and Game_𝑀,ℐ𝑅 or distinguishing between Game_𝑀,ℐ^∗ and Game_{𝑀𝑅,ℐ𝑅}.

Definition 11 (strong anonymity). One says that an IBE system has strong anonymity, if no probabilistic polynomial time adversary 𝒜 has a nonnegligible advantage in distinguishing between Game_𝑀,ℐ^∗ and Game_Random.

Obviously, weak anonymity is the standard definition shown in previous articles where the target identity is indistinguishable from a random identity. It is easy to see that weak anonymity is required for all anonymous IBE systems and strong anonymity implies weak anonymity. So weak anonymity is also called standard anonymity, while strong anonymity is called superstandard anonymity. In the next section, we will analyse some IBE systems based on our definitions of anonymity. We will see that these IBE systems all have strong anonymity. To further clarify the anonymity of IBE systems, we use the difference between Game_{𝑀𝑅,ℐ𝑅} and Game_Random to define two types of anonymity, named type 1 anonymity and type 2 anonymity. First we define the equivalence of two games. Let Game_A, Game_B be two games. If any ciphertext output by Game_A can seem as a properly distributed ciphertext output by Game_B and vice versa, we say that Game_A equals Game_B or Game_A=Game_B. Obviously, Game_A=Game_B means that Game_A is indistinguishable from Game_B. However, if two games are indistinguishable, they are not always equivalent. For example, for any IND-IND-CPA secure IBE system, Game_𝑀,ℐ^∗≠Game_𝑀𝑅,ℐ^∗, but they are indistinguishable according to the definition of IND-ID-CPA security.

Definition 12. For an anonymous IBE system ℰ, if Game_{𝑀𝑅,ℐ𝑅}=Game_Random, one says that ℰ has type 1 anonymity, or else ℰ has type 2 anonymity.

If an IBE system ℰ has only weak anonymity, it is obvious that Game_{𝑀𝑅,ℐ𝑅}≠Game_Random; that is, ℰ has type 2 anonymity. So there is no type 1 anonymous IBE system with only weak anonymity. For a strongly anonymous IBE system, type 1 anonymity always means that it only needs to prove ℰ’s anonymity in the ANON-IND-ID-CPA game or in the ANON-ID-CPA game, while type 2 anonymity always means that ℰ needs additional steps to prove strong anonymity, for example, proving the indistinguishability of transition from Game_{𝑀𝑅,ℐ𝑅} to Game_Random.

Note that there is some IBE system which has the property Game_{𝑀𝑅,ℐ𝑅}=Game_Random, such as Boneh-Boyen IBE system. In Boneh-Boyen IBE system, a ciphertext is like 𝑀𝑒(𝑔,𝑔)^𝛼𝑠, (𝑢^ℐℎ)^𝑠, 𝑔^𝑠. It is easy to see that a random tuple is still a valid ciphertext for some identity and message. But as we know, Boneh-Boyen IBE system is not anonymous because there is a gap between Game_𝑀,ℐ and Game_𝑀,ℐ𝑅.

4. Anonymity of Some IBE Systems

In this section, we analyse some IBE systems based on our definitions of anonymity. We discuss three famous anonymous IBE systems: Gentry IBE System [9], Boyen-Waters IBE system [8], and Lewko IBE System [26]. We show that these three IBE systems are all strongly anonymous but have different types.

4.1. Gentry IBE System [9]

We show that Gentry’s anonymous IBE system has type 1 strong anonymity. We first briefly describe Gentry IBE system as follows.

Setup(1^λ). Given the security parameter 𝜆, the setup algorithm first gets (𝑝,𝔾,𝔾_𝑇,𝑔,𝑒)←𝒢(𝜆). Next it chooses another random generator ℎ∈𝔾 and random integer 𝛼∈ℤ_𝑝. Then the setup algorithm sets 𝑔₁=𝑔^𝛼. The public key PK is published as PK=𝑔,𝑔₁,ℎ, (8) and the master key MK is MK=(𝛼). (9)

KeyGen(MK, ℐ). To generate the secret key SK_ℐ for an identity ℐ∈ℤ_𝑝, the key extract algorithm chooses random 𝑟_ℐ∈ℤ_𝑝 and outputs SK_ℐ as SK_ℐ=𝑟_ℐ,ℎ𝑔^{−𝑟ℐ1/(𝛼−ℐ)}. (10)

The constraints are that ℐ≠𝛼 and the PKG always uses the same random value 𝑟_ℐ for ℐ.

Encrypt(PK, ℐ, M). To encrypt a message 𝑀∈𝔾_𝑇 for an identity ℐ, the algorithm chooses random integers 𝑠∈ℤ_𝑝 and outputs the ciphertext CT as CT=𝑀⋅𝑒𝑔,ℎ^−𝑠,𝑔^𝑠₁𝑔^{−𝑠⋅ℐ},𝑒𝑔,𝑔^𝑠. (11)

Decrypt(SK_ℐ, CT). To decrypt a ciphertext CT=(𝐶,𝐶₁,𝐶₂) for an identity ℐ, using the corresponding secret key SK_ℐ=(𝑟_ℐ,ℎ_ℐ) outputs 𝑀=𝐶⋅𝑒ℎ_ℐ,𝐶₁⋅𝐶^𝑟ℐ₂. (12)

Lemma 13 (see [9, Theorem 1]). Gentry IBE system is ANON-IND-ID-CPA secure.

Lemma 14. For Gentry IBE system, 𝐺𝑎𝑚𝑒_{𝑀𝑅,ℐ𝑅}=𝐺𝑎𝑚𝑒_{𝑅𝑎𝑛𝑑𝑜𝑚}.

Proof. Let 𝒞₁ be the set of all the possible ciphertext output by Game_{𝑀𝑅,ℐ𝑅} and 𝒞₂ the set of all the possible ciphertext outputs by Game_Random. We will show that 𝒞₁=𝒞₂.
Obviously, we have 𝒞₁⊂𝒞₂. Note that this claim is true for all IBE systems.
Next, for a random tuple (𝐶,𝐶₁,𝐶₂), where 𝐶₁∈𝔾 and 𝐶,𝐶₂∈𝔾_𝑇, we say that it is a valid ciphertext of Gentry-AIBE system. At first we can set 𝐶₂=𝑒(𝑔,𝑔)^𝑠 for some 𝑠 and then we can set 𝐶₁=𝑔^𝑠₁𝑔^{−𝑠⋅ℐ} for some identity ℐ and 𝐶=𝑀⋅𝑒(𝑔,ℎ)^−𝑠 for some message 𝑀. So we have 𝒞₂⊂𝒞₁.
As a result, 𝒞₁=𝒞₂. This means that the challenge ciphertext output by Game_{𝑀𝑅,𝐼𝑅} can seem as a challenge ciphertext by Game_Random and vice versa. Then for Gentry-AIBE system, Game_{𝑀𝑅,𝐼𝑅}=Game_Random.

From Lemmas 13 and 14, we get the following result.

Theorem 15. Gentry IBE system has type 1 strong anonymity.

4.2. Boyen-Waters IBE System [8]

For an anonymous IBE system, equation Game_{𝑀𝑅,ℐ𝑅}=Game_Random means that it is intrinsically strongly anonymous, just as we showed for Gentry IBE system in the previous section. The equation also holds for some previous systems, for example, Boneh-Franklin IBE system. But for some strongly anonymous IBE systems, it does not hold; that is, Game_{𝑀𝑅,𝐼𝑅}≠Game_Random. In fact, these two games are computationally indistinguishable under some assumption, for example, the decisional linear assumption.

As an example, we will show that Boyen-Waters anonymous IBE system is a type 2 anonymous IBE system; that is, it does not satisfy the equation. We first briefly describe Boyen-Waters IBE system as follows.

Setup(1^λ). Given the security parameter 𝜆, the setup algorithm first gets (𝑝,𝔾, 𝔾_𝑇,𝑔,𝑒)←𝒢(𝜆). Next it chooses another two random group elements 𝑔₀,𝑔₁∈𝔾 and five random integers 𝜔,𝑡₁,𝑡₂,𝑡₃,𝑡₄∈ℤ_𝑝. Then the setup algorithm sets Ω=𝑒(𝑔,𝑔)^{𝑡1𝑡2𝜔},𝑣₁=𝑔^𝑡1,𝑣₂=𝑔^𝑡2,𝑣₃=𝑔^𝑡3,𝑣₄=𝑔^𝑡4. The public key PK is published as PK=Ω,𝑔,𝑔₀,𝑔₁,𝑣₁,𝑣₂,𝑣₃,𝑣₄, (13) and the master key MK is MK=𝜔,𝑡₁,𝑡₂,𝑡₃,𝑡₄. (14)

KeyGen(MK, ℐ). To generate the secret key SK_ℐ for an identity ℐ∈ℤ_𝑝, the key extract algorithm chooses random 𝑟₁,𝑟₂∈ℤ_𝑝 and outputs SK_ℐ as SK_ℐ=𝑔^{𝑟1𝑡1𝑡2+𝑟2𝑡3𝑡4},𝑔^−𝜔𝑡2𝑔₀𝑔^ℐ₁^{−𝑟1𝑡2},𝑔^−𝜔𝑡1𝑔₀𝑔^ℐ₁^{−𝑟1𝑡1},𝑔₀𝑔^ℐ₁^{−𝑟2𝑡4},𝑔₀𝑔^ℐ₁^{−𝑟2𝑡3}. (15)

Encrypt(PK, ℐ, M). To encrypt a message 𝑀∈𝔾_𝑇 for an identity ℐ, the algorithm chooses random integers 𝑠,𝑠₁,𝑠₂∈ℤ_𝑝 and outputs the ciphertext CT as CT=𝑀Ω^𝑠,𝑔₀𝑔^ℐ₁^𝑠,𝑣^𝑠−𝑠1₁,𝑣^𝑠1₂,𝑣^𝑠−𝑠2₃,𝑣^𝑠2₄. (16)

Decrypt(SK_ℐ, CT). To decrypt a ciphertext CT=(𝐶,𝐶₁,𝐶₂,𝐶₃,𝐶₄,𝐶₅) for an identity ℐ, using the corresponding secret key SK_ℐ=(𝑑₁,𝑑₂,𝑑₃,𝑑₄,𝑑₅) outputs 𝑀=𝐶⋅𝑒𝑑₁,𝐶₁⋅𝑒𝑑₂,𝐶₂⋅𝑒𝑑₃,𝐶₃⋅𝑒𝑑₄,𝐶₄⋅𝑒𝑑₅,𝐶₅. (17)

Using the conjunction of Lemmas 1,2, and 3 in [8], we have the following result for Boyen-Waters IBE system.

Lemma 16. For Boyen-Waters IBE system, 𝐺𝑎𝑚𝑒_𝑀,ℐ^∗ and 𝐺𝑎𝑚𝑒_{𝑅𝑎𝑛𝑑𝑜𝑚} are computationally indistinguishable under the decisional BDH and decisional linear assumptions.

Now we show that Boyen-Waters IBE system has type 2 anonymity.

Lemma 17. For Boyen-Waters IBE system, 𝐺𝑎𝑚𝑒_{𝑀𝑅,ℐ𝑅}≠𝐺𝑎𝑚𝑒_{𝑅𝑎𝑛𝑑𝑜𝑚}.

Proof. Given a random tuple (𝑅,𝑅₁,𝑅₂,𝑅₃,𝑅₄,𝑅₅) where 𝑅∈𝔾_𝑇 and 𝑅₁,…,𝑅₅∈𝔾, we say that it has at most 1/𝑝 probability to be a valid ciphertext of BW-AIBE system. At first we set 𝑅₃=𝑣^𝑠1₂ and 𝑅₅=𝑣^𝑠2₄ for some 𝑠₁ and 𝑠₂, respectively, and then we can set 𝑅₂=𝑣^𝑠−𝑠1₁ for some 𝑠, but a valid ciphertext requires that 𝑅₄=𝑣^𝑠−s2₃. Since 𝑅₄ is a random element of 𝔾, so 𝑅₄ has only 1/𝑝 probability to be 𝑣^𝑠−𝑠2₃. When 𝑅₄≠𝑣^𝑠−𝑠2₃, the random tuple cannot be a valid ciphertext which means that Game_{𝑀𝑅,𝐼𝑅}≠Game_Random.

From Lemmas 16 and 17, we can easily get the following result.

Theorem 18. Boyen-Waters IBE system has type 2 strong anonymity.

4.3. Lewko IBE System [26]

Boyen-Waters IBE system only has selective security. We now show that a fully secure IBE system, Lewko IBE system, has type 2 full anonymity. Lewko IBE system is constructed from dual orthonormal bases and can seem as a translation of Lewko-Waters IBE system [11] in prime order groups. In Lewko’s original description, she only gave a proof for chosen plaintext security.

Lewko IBE system is constructed on dual orthonormal bases of dual pairing vector spaces. We first review vectors of group elements. Given a group element 𝑔∈𝔾 and a vector 𝐯=(𝑣₁,…,𝑣_𝑛)∈ℤ^𝑛_𝑝, we write 𝑔^𝐯 to denote a 𝑛-tuple of elements of 𝔾∶𝑔^𝐯∶=(𝑔^𝑣1,…,𝑔^𝑣𝑛). For any 𝑎∈ℤ_𝑝 and 𝐯,𝐰∈ℤ^𝑛_𝑝, we have (𝑔^𝐯)^𝑎=𝑔^𝑎𝐯=(𝑔^𝑎𝑣1,…,𝑔^𝑎𝑣𝑛) and 𝑔^𝐯+𝐰=(𝑔^𝑣1+𝑤1,…,𝑔^{𝑣𝑛+𝑤𝑛}). We also use 𝑒_𝑛 to denote the pairing of vectors: 𝑒_𝑛𝑔^𝐯,𝑔^𝐰∶=^𝑛_𝑖=1𝑒𝑔^𝑣𝑖,𝑔^𝑤𝑖=𝑒𝑔,𝑔^𝐯⋅𝐰. (18)

For a fixed (constant) dimension 𝑛, we choose two random bases 𝔹∶=(𝐛₁,…,𝐛_𝑛) and 𝔹^∗∶=(𝐛₁,…,𝐛_𝑛) of ℤ_𝑝^𝑛×𝑛, subject to the constraint that 𝐛_𝑖⋅𝐛^∗_𝑗=0,𝑖≠𝑗𝜓,𝑖=𝑗mod𝑝. (19)

(𝔹,𝔹^∗) are called dual orthonormal bases and Dual(ℤ^𝑛_𝑝) denotes the set of dual orthonormal bases. We then describe Lewko IBE system as follows.

Setup(1^λ). Given the security parameter 𝜆, the setup algorithm first gets (𝑝,𝔾, 𝔾_𝑇,𝑔,𝑒)←𝒢(𝜆). Next it chooses random dual orthonormal bases (𝔻,𝔻^∗) from Dual(ℤ⁶_𝑝). Let 𝔻=(𝐝₁,…,𝐝₆) and 𝔻=(𝐝^∗₁,…,𝐝^∗₆). It also chooses random values 𝛼,𝜃,𝜎∈ℤ_𝑝. The public key is published as PK=𝑝,𝔾,Ω=𝑒𝑔,𝑔^{𝛼𝜃𝐝1⋅𝐝∗1},𝑔^𝐝1,…,𝑔^𝐝4, (20)

and the master key is MK=𝑔^𝜃𝐝∗1,𝑔^{𝛼𝜃𝐝∗1},𝑔^𝜃𝐝∗2,𝑔^𝜎𝐝∗3,𝑔^𝜎𝐝∗4. (21)

KeyGen(MK, ℐ). The key generation algorithm chooses random 𝑟₁,𝑟₂∈ℤ_𝑝 and outputs the secret key as SK_ℐ∶=𝑔^{(𝛼+𝑟1ℐ)𝜃𝐝∗1−𝑟1𝜃𝐝∗2+𝑟2ℐ𝜎𝐝∗3−𝑟2𝜎𝐝∗4}. (22)

Encrypt(PK, ℐ, M). To encrypt a message 𝑀∈𝔾_𝑇 for an identity ℐ, the algorithm chooses random integers 𝑠₁,𝑠₂∈ℤ_𝑝 and outputs the ciphertext as CT=𝐶₁∶=𝑀Ω^𝑠1,𝐶₂∶=𝑔^{𝑠1𝐝1+𝑠1ℐ𝐝2+𝑠2𝐝3+𝑠2ℐ𝐝4}. (23)

Decrypt(SK_ℐ, CT). The decryption algorithm computes the message as 𝐶𝑀=¹𝑒_𝑛SK_ℐ,𝐶₂. (24)

Security proof of Lewko IBE system used the dual system encryption technique [10]. Its semifunctional keys are like 𝑔^{(𝛼+𝑟1ℐ)𝜃𝐝∗1−𝑟1𝜃𝐝∗2+𝑟2ℐ𝜎𝐝∗3−𝑟2𝜎𝐝∗4+𝑡5𝐝∗5+𝑡6𝐝∗6} and its semifunctional ciphertext is (𝑀Ω^𝑠1,𝑔^{𝑠1𝐝1+𝑤𝐝2+𝑠2𝐝3+𝑠2ℐ𝐝4+𝑠5𝐝5+𝑠6𝐝6}) where 𝑡₅,𝑡₆,𝑠₅,𝑠←₆^𝑅ℤ_𝑝. Let Game_Final be the game, where all returned keys are semifunctional and the challenge ciphertext is (𝑅,𝑔^{𝑠1𝐝1+𝑤𝐝2+𝑠2𝐝3+𝑠2ℐ𝐝4+𝑠5𝐝5+𝑠6𝐝6}), where 𝑅←^𝑅𝔾_𝑇 and 𝑤,𝑠₅,𝑠←₆^𝑅ℤ_𝑝. In [26], Lewko showed that Game_𝑀,ℐ is indistinguishable from Game_Final′ under the subspace assumption. We continue her work and show that her IBE system has type 2 strong anonymity.

We first review the subspace assumption introduced by Lewko in [26].

Definition 19. Given a group generation 𝒢, one defines the following distribution: 𝐺∶=𝑝,𝔾,𝔾_𝑇,𝑔,𝑒⟵^𝑅𝒢,𝔹,𝔹⟵^∗𝑅Dualℤ^𝑛_𝑝,𝜂,𝛽,𝜏₁,𝜏₂,𝜏₃,𝜇₁,𝜇₂,𝜇⟵₃^𝑅ℤ_𝑝,𝑈₁∶=𝑔^{𝜇1𝐛1+𝜇2𝐛𝑘+1+𝜇3𝐛2𝑘+1},𝑈₂∶=𝑔^{𝜇1𝐛2+𝜇2𝐛𝑘+2+𝜇3𝐛2𝑘+2}𝑈,…,_𝑘∶=𝑔^{𝜇1𝐛𝑘+𝜇2𝐛2𝑘+𝜇3𝐛3𝑘},𝑉₁∶=𝑔^{𝜏1𝜂𝐛∗1+𝜏2𝛽𝐛∗𝑘+1},𝑉₂∶=𝑔^{𝜏1𝜂𝐛∗2+𝜏2𝛽𝐛∗𝑘+2}𝑉,…,_𝑘∶=𝑔^{𝜏1𝜂𝐛∗𝑘+𝜏2𝛽𝐛∗2𝑘},𝑊₁∶=𝑔^{𝜏1𝜂𝐛∗1+𝜏2𝛽𝐛∗𝑘+1+𝜏3𝐛∗2𝑘+1},𝑊₂∶=𝑔^{𝜏1𝜂𝐛∗2+𝜏2𝛽𝐛∗𝑘+2+𝜏3𝐛∗2𝑘+2}𝑊,…,_𝑘∶=𝑔^{𝜏1𝜂𝐛∗𝑘+𝜏2𝛽𝐛∗2𝑘+𝜏3𝐛∗3𝑘},𝐷∶=𝑔^𝐛1,𝑔^𝐛2,…,𝑔^𝐛2𝑘,𝑔^𝐛3𝑘+1,…,𝑔^𝐛𝑛,𝑔^𝜂𝐛∗1𝑔,…,_{𝜂𝐛∗𝑘},𝑔^{𝛽𝐛∗𝑘+1},…,𝑔^{𝛽𝐛∗2𝑘},𝑔^{𝐛∗2𝑘+1}𝑔,…,_𝐛∗𝑛,𝑈₁,𝑈₂,…,𝑈_𝑘,𝜇₃. (25) We define the advantage of an algorithm 𝒜 in breaking the subspace assumption to be Pr𝒜𝐷,𝑉₁,…,𝑉_𝑘=1−Pr𝒜𝐷,𝑊₁,…,𝑊_𝑘=1. (26)
We say that the subspace assumption holds if no probabilistic polynomial time algorithm has a nonnegligible advantage in breaking the subspace assumption.

Lemma 20. Let 𝐺𝑎𝑚𝑒_{𝐹𝑖𝑛𝑎𝑙′} be the game, where all returned keys are semifunctional and the challenge ciphertext is (𝑅,𝑔^{𝑠1𝐝1+𝑤2𝐝2+𝑠2𝐝3+𝑤4𝐝4+𝑠5𝐝5+𝑠6𝐝6}), where 𝑅←^𝑅𝔾_𝑇 and 𝑤₂,𝑤₄,𝑠₅,𝑠←₆^𝑅ℤ_𝑝. If there exists a polynomial time algorithm 𝒜, where 𝐺𝑎𝑚𝑒_{𝐹𝑖𝑛𝑎𝑙}𝐴𝑑𝑣_𝒜−𝐺𝑎𝑚𝑒_{𝐹𝑖𝑛𝑎𝑙′}𝐴𝑑𝑣_𝒜=𝜖, then we can construct a polynomial time algorithm ℬ with advantage 𝜖 to break the subspace assumption with 𝑛=6 and 𝑘=1.

Proof. ℬ is given 𝐷∶=(𝑔^𝐛1,𝑔^𝐛2,𝑔^𝐛4,𝑔^𝐛5,𝑔^𝐛6,𝑔^𝜂𝐛∗1,𝑔^𝛽𝐛∗2,𝑔^𝐛∗3,𝑔^𝐛∗4,𝑔^𝛽𝐛∗5,𝑔^𝛽𝐛∗6,𝑈₁,𝜇₃) along with 𝑇₁. ℬ should decide whether 𝑇₁ is distributed as 𝑔^{𝜏1𝜂𝐛∗1+𝜏2𝛽𝐛∗2} or as 𝑔^{𝜏1𝜂𝐛∗1+𝜏2𝛽𝐛∗2+𝜏3𝐛∗3}.
At first ℬ implicitly sets 𝐝₁=𝐛^∗₆,𝐝₂=𝐛^∗₅,𝐝₃=𝐛^∗₄,𝐝₄=𝐛^∗₃,𝐝₅=𝐛^∗₂,𝐝₆=𝐛^∗₁. Then ℬ can produce 𝑔^𝐝1,…,𝑔^𝐝4 for the public parameters. Next ℬ sets 𝐝^∗₁=𝐛₆,𝐝^∗₂=𝐛₅,𝐝^∗₃=𝐛₄,𝐝^∗₄=𝐛₃,𝐝^∗₅=𝐛₂,𝐝^∗₆=𝐛₁. Note that ℬ only does not know 𝑔^𝐝∗4.
ℬ chooses random values 𝜃,𝜎,𝛼∈ℤ_𝑝 for itself. It can compute 𝑒(𝑔,𝑔)^{𝛼𝜃𝐝1⋅𝐝∗1} as (𝑒_𝑛(𝑔^𝐛∗6,𝑔^𝐛6))^𝛼𝜃. It gives 𝒜 the public key PK∶=𝔾,𝑝,𝑒𝑔,𝑔^{𝛼𝜃𝐝1⋅𝐝∗1},𝑔^𝐝1,…,𝑔^𝐝4. (27)
To respond a key query for ℐ, ℬ chooses random values 𝑟₁,𝑟^′₂,𝑡^′₅,𝑡^′₆∈ℤ_𝑝. It will set 𝑟₂=𝜇₃𝑟^′₂. It forms the secret key as SK_ℐ∶=𝑈₁^𝜎𝑟′2𝑔^{(𝛼+𝑟1ℐ)𝜃𝐝∗1−𝑟1𝜃𝐝∗2+𝜇3𝑟′2ℐ𝜎𝐝∗3+𝑡′5𝐝∗5+𝑡′6𝐝∗6}. (28)
At the challenge phase, ℬ receives two messages 𝑀₀,𝑀₁ and a challenge identity ℐ^∗. ℬ chooses a random bit 𝑏∈{0,1}, a random element 𝑅∈𝔾_𝑇, and random values 𝑤₂,𝑠₁,𝑠₂∈ℤ_𝑝 and sets 𝐶₁∶=𝑅,𝐶₂∶=𝑔^{𝑠1𝐝1+𝑤2𝐝2+𝑠2𝐝3+𝑠2ℐ∗𝐝4}𝑇₁. (29)
If 𝑇₁=𝑔^{𝜏1𝜂𝐛∗1+𝜏2𝛽𝐛∗2}, then the exponent vector of 𝑇₁ is a random linear combination of 𝐝₅ and 𝐝₆, so it is in Game_Final. If the exponent of 𝑇₁ additionally has 𝜏₃𝐛^∗₃=𝜏₃𝐝₄, it is in Game_Final′. Therefore, ℬ can use the output of 𝒜 to break the subspace assumption.

Theorem 21. Lewko IBE system has type 2 strong anonymity.

Proof. From Lemma 20 we know that the ciphertext of Lewko IBE system leaks no information about target identity, so it is anonymous.
Furthermore, note that 𝐝₁,…,𝐝₆ is a base of ℤ_𝑝^6×6, so 𝑔^{𝑠1𝐝1+𝑤2𝐝2+𝑠2𝐝3+𝑤4𝐝4+𝑠5𝐝5+𝑠6𝐝6} can seem a random element in ℤ_𝑝^6×6. In other words, Game_Final′=Game_Random. So Lewko IBE system has strong anonymity.
Obviously, the set of all possible 𝐶₂ is contained in span(𝑔^𝐝1,𝑔^𝐝2,𝑔^𝐝3,𝑔^𝐝4). Note that any nonzero vectors in span(𝑔^𝐝5,𝑔^𝐝6) are not included in span(𝑔^𝐝1,𝑔^𝐝2,𝑔^𝐝3,𝑔^𝐝4), so Game_{𝑀𝑅,ℐ𝑅}≠Game_Random for Lewko IBE system which means that Lewko IBE system has type 2 anonymity.

4.4. Comparison

Like previous analysis for Gentry IBE system, Boyen-Waters IBE system, and Lewko IBE system, we can analyse other anonymous IBE systems. A brief comparison for some anonymous IBE systems is given in Table 1. We would find that all listed IBE systems have strong anonymity, that is, superstandard anonymity. Though weak anonymity, that is, standard anonymity, is the current definition of anonymity, to the best of our knowledge, there is no IBE system having only weak anonymity. Hence we leave an open problem to construct an IBE system with only weak anonymity.

Table 1 

Comparison.

5. Conclusion

In this paper, we discuss the anonymity of identity-based encryption systems. Anonymity can be divided into two degrees: weak anonymity and strong anonymity. If an IBE system has weak anonymity, the target identity of its ciphertext cannot be distinguished from a random identity. For strongly anonymous IBE systems, the whole ciphertext cannot be distinguished from a random tuple. We also discuss the type of anonymity and divide it into two types: type 1 means that a random tuple can be seen as a valid ciphertext for some identity, while type 2 cannot. We show that some current anonymous IBE systems, such as Gentry IBE system, Boyen-Waters IBE system, and Lewko IBE system, have strong but different type of anonymity. We hope that our analysis of anonymity would help to construct more anonymous IBE and related systems.

Acknowledgments

This work was supported by Chongqing Natural Science Foundation (no. cstc2013jcyjA40019) and the authors would like to thank the anonymous referees for helpful suggestions.