## 4 Conversion Method for CCA-Secure IBKEM
### Security Proof
In the challenge phase, the challenger randomly selects \(k^{\prime}\) instead of computing \(k^{*}\leftarrow\mathsf{IBKEM}.\mathsf{Encap}(pp,ID^{*};x)\). The other procedures are the same as in Game 3. Finally, it outputs \((CT^{*},K^{*})\). We can show that a distinguisher between Game 4 and Game 3 implies an adversary that breaks the IND-ID-CPA security of the \(\mathsf{IBKEM}\) scheme. For the sake of simplicity, we prove this later. Then, we have  
\[|\Pr[\mathsf{Win}_{4}]-\Pr[\mathsf{Win}_{3}]|\leq\epsilon_{ \mathsf{IND-ID-CPA}}^{\mathsf{IBKEM}}.\]  
**Game 5. ** This game is identical to Game 4 except that it is executed with \(b=0\). In other words, the challenger always returns \(K^{*}\stackrel{{\complement}}{{\subseteq}}\{0,1\}^{\ell}\) instead of computing \(K^{*}=H_{2}(stmt=(pp,ID^{*},ct^{*},k^{\prime})\), \(com=(com_{sim}^{ct^{*}},com_{sim}^{k^{\prime}})\), \(\pi_{sim}^{*}=(s,c))\). \(\mathcal{A}\) cannot distinguish Game 5 from Game 4 unless \(\mathcal{A}\) queries the tuple \((stmt=(pp,ID^{*},ct^{*},k^{\prime})\), \(com=(com_{sim}^{ct^{*}},com_{sim}^{k^{\prime}})\), \(\pi_{sim}^{*}=(s,c))\) to the \(H_{2}\) oracle. Note that \(k^{\prime}\) is random from \(\mathcal{A}\)'s viewpoint because \(ct^{*}\) is independent of \(k^{\prime}\). Therefore, the probability that \(\mathcal{A}\) queries the tuple to the \(H_{2}\) oracle is \(1/|\mathcal{K}|\). Then, we have  
\[|\Pr[\mathsf{Win}_{5}]-\Pr[\mathsf{Win}_{4}]|\leq 1/|\mathcal{K}|.\]  
**Game 6. ** This game is identical to Game 5 except that the challenge ciphertexts are computed differently. In the challenge phase, the challenger uses back \(k^{*}\leftarrow\mathsf{IBKEM}.\mathsf{Encap}(pp,ID^{*};x)\). The other procedures are the same as in Game 5. Finally, it outputs \((CT^{*},K^{*})\). Like the case between Game 4 and Game 3, we can show that a distinguisher between Game 6 and Game 5 implies an adversary that breaks the IND-ID-CPA security of the \(\mathsf{IBKEM}\) scheme. For the sake of simplicity, we prove this later. Then, we have  
\[|\Pr[\mathsf{Win}_{6}]-\Pr[\mathsf{Win}_{5}]|\leq\epsilon_{ \mathsf{IND-ID-CPA}}^{\mathsf{IBKEM}}.\]  
**Game 7. ** This game is identical to Game 6 except that the decapsulation query is operated differently. In this game, the challenger changes the operation of decapsulation query back to normal. For a given pair \((CT,ID)\), the challenger generates \(SK_{ID}\) using \(MSK\) and decapsulates the ciphertext \(CT\) using \(SK_{ID}\). Like the case between Game 3 and Game 2, \(\mathcal{A}\) cannot distinguish Game 7 from Game 6 unless it submits a ciphertext with a forged proof for a false statement. Then, by the simulation soundness of \(NIZK\) with respect to \(q_{d}\) decapsulation queries, we have  
\[|\Pr[\mathsf{Win}_{7}]-\Pr[\mathsf{Win}_{6}]|\leq q_{d}\cdot \epsilon_{\SS}.\]  
**Game 8**. : This game is identical to Game 7 except that the challenge ciphertext is computed differently. The challenger uses the real proving algorithm for \(\mathsf{NIZK}\) instead of using simulated proofs. Due to the zero-knowledge property of \(\mathsf{NIZK}\), we have  
\[|\Pr[\mathsf{Win}_{8}]-\Pr[\mathsf{Win}_{7}]|\leq\epsilon_{\mathsf{ZK}}.\]  
**Game 9**. : This game is identical to Game 8 but it does not abort when the event \(\mathsf{Coll}\) occurs during the simulation. Due to the collision resistance of the hash functions, we have  
\[|\Pr[\mathsf{Win}_{9}]-\Pr[\mathsf{Win}_{8}]|\leq\epsilon_{\mathsf{CR}}.\]  
Note that Game 9 is identical to the IND-ID-CCA security game executed with \(b=0\). Then, we have  
\[|\Pr[\text{Win}_{1}]-\Pr[\text{Win}_{0}]|\leq\epsilon_{\text{CR}}.\]0  
**Lemma 3**. : _If there exists a polynomial time distinguisher \(\mathcal{D}\) between Game 3 and Game 4, then there exists a polynomial time adversary \(\mathcal{A}\) that breaks the IND-ID-CPA security of IBKEM._  
Proof. : Let \(\mathcal{D}\) be a distinguisher between Game 3 and Game 4. Then, we show how to construct \(\mathcal{A}\) so that it wins the IND-ID-CPA security game of IBKEM using \(\mathcal{D}\) with the same advantage.