## 4 Conversion Method for CCA-Secure IBKEM
### Conversion Method  
Similar to the previous KEM, this conversion method is for a special case of IBKEM which is compatible with the NIZK schemes. We suppose that the IBKEM.Encap algorithm takes public parameters \(\mathsf{pp}\), an identity ID, and random coins \(x\) as inputs and returns a key \(\mathsf{k}\) and a ciphertext \(\mathsf{ct}\) (e.g., \((\mathsf{k},\mathsf{ct})\leftarrow\mathsf{IBKEM.Encap}(\mathsf{pp},\mathsf{ ID};x)\)). Then, we say that an IBKEM scheme is NIZK-_compatible_ if a tuple \((\mathsf{pp},\mathsf{ID},\mathsf{ct},\mathsf{k})\) can be parsed as the statement for proving a relation for discrete logarithms using the witness \(x\). For instance, the Boneh-Franklin IBKEM and Boneh-Boyen IBKEM are NIZK-compatible [12].  
Let \(\mathsf{IBKEM}=(\mathsf{IBKEM.Setup},\mathsf{IBKEM.KeyGen},\mathsf{IBKEM. Encap},\mathsf{IBKEM.Decap})\) be IND-ID-CPA-secure and NIZK-compatible. Using the IBKEM and NIZK scheme, the generic construction of the CCA-secure \(\mathsf{IBKEM}^{\prime}=(\mathsf{IBKEM.Setup}^{\prime},\mathsf{IBKEM.KeyGen}^{ \prime},\mathsf{IBKEM.Encap}^{\prime},\mathsf{IBKEM.Decap}^{\prime})\) by [PERSON] et al. is described as follows.  
**IBKEM.Setup\({}^{\prime}(\lambda)\)**: Given security parameter \(\lambda\), the setup algorithm proceeds as follows.  
1. Generate \(\mathsf{msk}\) and \(\mathsf{pp}\) by running \(\mathsf{IBKEM.Setup}(\lambda)\).
2. Choose \(H_{1}:\{0,1\}^{*}\rightarrow\{0,1\}^{k}\) and \(H_{2}:\{0,1\}^{*}\rightarrow\{0,1\}^{\ell}\) for \(k,l\in\mathbb{Z}^{+}\).
3. Output \(\mathsf{MSK}=\mathsf{msk}\) and \(\mathsf{PP}=(\mathsf{pp},H_{1},H_{2})\).  
**IBKEM.KeyGen\({}^{\prime}\)**(PP, \(\mathsf{MSK},\mathsf{ID}\)): Given public parameters \(\mathsf{PP}=(\mathsf{pp},H_{1},H_{2})\), a master secret key \(\mathsf{MSK}\), and an identity ID, the KeyGen algorithm proceeds as follows.  
1. Compute \(\mathsf{sk_{ID}}\stackrel{{\$}}{{\leftarrow}}\mathsf{IBKEM.KeyGen}( \mathsf{pp},\mathsf{msk},\mathsf{ID})\).
2. Set \(\mathsf{SK_{ID}}=\mathsf{sk_{ID}}\) and output \(\mathsf{SK_{ID}}\).  
**IBKEM.Encap\({}^{\prime}(\text{PP},\text{ID})\)**: Given public parameters \(\text{PP}=(\text{pp},H_{1},H_{2})\) and an identity ID, the Encap algorithm proceeds as follows.  
Choose the randomness \(x\) and compute \((\text{ct},k)\leftarrow\text{IBKEM.Encap}\left(\text{pp},\text{ID};x\right)\).  
Set \(\text{stmt}=(\text{pp},\text{ID},\text{ct},k)\) and \(\text{wt}=x\).  
Run \(\pi\leftarrow\mathcal{P}^{H_{1}}(\text{stmt},\text{wt})\).  
Choose the randomness \(r\) and compute com.  
Compute \(c\,=H_{1}(\text{stmt},\text{com})\) and the relevant \(s\).  
Output the proof \(\pi=(s,c)\).  
Set \(\text{K}\gets H_{2}(\text{stmt},\text{com},\pi)\).  
Output \(\text{K}\) and \(\text{CT}=(\text{ct},\pi)\).  
**IBKEM.Decap\({}^{\prime}(\text{PP},\text{CT},\text{SK}_{\text{ID}})\)**: Given a public key \(\text{PP}=(\text{pp},H_{1},H_{2})\), a ciphertext \(\text{CT}=(\text{ct},\pi=(s,c))\), and a private \(\text{SK}_{\text{ID}}=\text{sk}_{\text{ID}}\), the Decap algorithm proceeds as follows.  
Compute \(\text{k}\leftarrow\text{IBKEM.Decap}(\text{pp},\text{ct},\text{sk}_{\text{ID}})\).  
Set \(\text{stmt}=(\text{pp},\text{ID},\text{ct},k)\).  
If \(1\leftarrow\mathcal{V}^{H_{1}}(\text{stmt},\pi)\), go on. Otherwise, abort.  
Deterministically compute com.  
If \(c=H_{1}(\text{stmt},\text{com})\), output 1. Otherwise, output 0.  
Set \(\text{K}\gets H_{2}(\text{stmt},\text{com},\pi)\) and output \(\text{K}\).