## 5 Application
### CCA-Secure Boneh-Boyen IBKEM  
Let \(\mathsf{GGen}^{\mathsf{DBDH}}(\lambda)\) be a bilinear group generator generating a group \(\mathcal{G}=(\mathbb{G}_{1},\mathbb{G}_{2},\)\(\mathbb{G}_{T},p,e)\), where the DBDH assumption holds. In the Boneh-Boyen IBKEM [24], public parameters consist of four group elements \((g_{1},y_{1},y_{2},\Lambda=e(g_{1},g_{2})^{\alpha})\in\mathbb{G}_{1}^{3}\times \mathbb{G}_{T}\) such that \(y_{1}=g_{1}^{x},y_{2}=g_{1}^{y}\) with corresponding master secret key \((g_{2},x,y,\alpha)\in\mathbb{G}_{2}\times\mathbb{G}_{p}^{2}\). For an identity ID, the secret key is generated by computing \(\mathsf{sk}_{\text{ID}}=(d_{1},d_{2})=(g_{2}^{\alpha+(x+H(\text{ID}))y^{t}},g_{2} ^{\alpha})\in\mathbb{G}_{2}^{2}\). The encapsulation is done by computing \(\mathsf{ct}=(\mathsf{ct}_{1},\mathsf{ct}_{2})=(g_{1}^{w},(y_{1}y_{2}^{H( \text{ID})})^{w})\in\mathbb{G}_{1}^{2}\) and \(\mathsf{k}=\Lambda^{w}\in\mathbb{G}_{T}\), and decapsulation is done by computing \(\mathsf{k}=e(\mathsf{ct}_{1},d_{1})/e(\mathsf{ct}_{2},d_{2})\in\mathbb{G}_{T}\). Based on this scheme, the transformed IND-CCA-secure scheme is described as follows. **IBKEM.Setup(\(\lambda\))**: For security parameter \(\lambda\), the setup algorithm proceeds as follows. 1. Generate \(\mathcal{G}=(\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},p,e)\stackrel{{ \mathsf{S}}}{{\leftarrow}}\mathsf{GGen}^{\mathsf{DBDH}}(\lambda)\). 2. Select two random generators \(g_{1}\in\mathbb{G}_{1}\) and \(g_{2}\in\mathbb{G}_{2}\). 3. Select random exponents \(x,y,\alpha\in\mathbb{Z}_{p}\). 4. Compute \(y_{1}=g_{1}^{x},y_{2}=g_{1}^{y}\), and \(\Lambda=e(g_{1},g_{2})^{\alpha}\). Select hash functions \(H:\{0,1\}^{*}\rightarrow\mathbb{Z}_{p}\), \(H_{1}:\{0,1\}^{*}\rightarrow\{0,1\}^{k}\subseteq\mathbb{Z}_{p}\) and \(H_{2}:\{0,1\}^{*}\rightarrow\{0,1\}^{\ell}\). \(6\). Output \(\mathsf{MSK}=(g_{2},x,y,\alpha)\) and \(\mathsf{PP}=(\mathcal{G},g_{1},y_{1},y_{2},\Lambda,H,H_{1},H_{2})\). **IBKEM.KeyGen**(\(\mathsf{PP},\mathsf{MSK},\mathsf{ID}\)): For public parameters \(\mathsf{PP}=(\mathcal{G},g_{1},y_{1},y_{2},\Lambda,H,H_{1},H_{2})\), a master secret key \(\mathsf{MSK}=(g_{2},x,y,\alpha)\), and an identity \(\mathsf{ID}\), the KeyGen algorithm proceeds as follows. 1. Select a random exponent \(t\in\mathbb{Z}_{p}\). 2. Compute \(\mathsf{SK}_{\mathsf{ID}}=(g_{2}^{\alpha+(x+H(\mathsf{ID}))y)t},g_{2}^{t})\in \mathbb{G}_{2}^{2}\). 3. Output \(\mathsf{SK}_{\mathsf{ID}}\). **IBKEM.Encap**(\(\mathsf{PP},\mathsf{ID}\)): For public parameters \(\mathsf{PP}=(\mathcal{G},g_{1},y_{1},y_{2},\Lambda,H,H_{1},H_{2})\) and an identity \(\mathsf{ID}\), the Encap algorithm proceeds as follows. 1. Select a random exponent \(w\in\mathbb{Z}_{p}\). 2. Compute \(Q_{\mathsf{ID}}=y_{1}y_{2}^{H(\mathsf{ID})}\in\mathbb{G}_{1}\). 3. Set \(\mathsf{stmt}=(g_{1},y_{1},y_{2},\Lambda,\mathsf{ID},g_{1}^{w},Q_{\mathsf{ID}} ^{w},\Lambda^{w})\) and \(\mathsf{wt}=w\). 4. Compute \(\pi\leftarrow\mathcal{P}^{H_{1}}(\mathsf{stmt},\mathsf{wt})\). 1. Select the random exponent \(r\in\mathbb{Z}_{p}\). 2. Set \(\mathsf{com}=(g_{1}^{r},Q_{\mathsf{ID}}^{w},\Lambda^{r})\in\mathbb{G}_{1}^{2} \times\mathbb{G}_{7}\). 3. Compute \(c\ =H_{1}(\mathsf{stmt},\mathsf{com})\) and \(s=r+wc\). 4. Output the proof \(\pi=(s,c)\). 5. Set \(\mathsf{K}\gets H_{2}(\mathsf{stmt},\mathsf{com},\pi)\). 6. Output \(\mathsf{K}\) and \(\mathsf{CT}=(g_{1}^{w},Q_{\mathsf{ID}}^{w},\pi)\). **IBKEM.Decap**(\(\mathsf{PP},\mathsf{CT},\mathsf{SK}_{\mathsf{ID}}\)): For public parameters \(\mathsf{PP}=(\mathcal{G},g_{1},y_{1},y_{2},\Lambda,H,H_{1},H_{2})\), a ciphertext \(\mathsf{CT}=(\mathsf{ct}_{1},\mathsf{ct}_{2},\pi=(s,c))\), and a private \(\mathsf{SK}_{\mathsf{ID}}=(d_{1},d_{2})\), the Decap algorithm proceeds as follows. 1. Compute \(\mathsf{k}=e(\mathsf{ct}_{1},d_{1})/e(\mathsf{ct}_{2},d_{2})\in\mathbb{G}_{7}\). 2. Set \(\mathsf{stmt}=(g_{1},y_{1},y_{2},\Lambda,\mathsf{ID},\mathsf{ct}_{1},\mathsf{ ct}_{2},\mathsf{k})\). 3. If \(1\gets\mathcal{V}^{H_{1}}(\mathsf{stmt},\pi)\), go on. Otherwise, abort. 1.