## 4 Conversion Method for CCA-Secure IBKEM
### Security Proof
\(\mathcal{A}\) receives as input a public parameter \(\mathsf{pp}\). Then, \(\mathcal{A}\) runs \(\mathcal{D}\) by simulating Game 3 with changes as follows. * In the setup phase, \(\mathcal{A}\) sends \(\mathsf{PP}=(\mathsf{pp},H_{1},H_{2})\) to \(\mathcal{D}\). * When asked a decapsulation query (CT,ID), if \(\mathsf{ID}\
eq\mathsf{ID}^{*}\), \(\mathcal{A}\) queries \(\mathsf{ID}\) for key generation oracle of its challenger, decapsulates \(\mathsf{CT}\), and returns it to \(\mathcal{D}\). Otherwise, if \(\mathsf{ID}\
eq\mathsf{ID}^{*}\), the procedure is the same as in Game 3. * In the challenge phase, the distinguisher \(\mathcal{D}\) sends \(\mathsf{ID}^{*}\) to \(\mathcal{A}\). Then, \(\mathcal{A}\) sends \(\mathsf{ID}^{*}\) to its challenger and receives the challenge ciphertext and key pair. Given the pair \((\mathsf{ct}^{*},k_{b}^{*})\), \(\mathcal{A}\) sets \(\mathsf{stmt}=(\mathsf{pp},\mathsf{ID}^{*},\mathsf{ct}^{*},k_{b}^{*})\) and generates simulated proof \(\pi_{\mathsf{sim}}^{*}\) on the statement \(\mathsf{stmt}\). Furthermore, \(\mathcal{A}\) sets \(K^{*}=H_{2}(\mathsf{stmt},\mathsf{com}_{\mathsf{sim}},\pi_{\mathsf{sim}}^{*})\), where \(\mathsf{com}_{\mathsf{sim}}\) is deterministically computed commitment from \((\mathsf{stmt},\pi_{\mathsf{sim}}^{*})\), and sends \((\mathsf{CT}^{*}=(\mathsf{ct}^{*},\pi_{\mathsf{sim}}^{*}),K^{*})\) to \(\mathcal{D}\). In the guess phase, \(\mathcal{D}\) outputs its guess. If the guess is \"Game 3\", \(\mathcal{A}\) outputs 1; otherwise, it output 0. Note that if \(b=1\), i.e., \(\mathsf{stmt}=(\mathsf{pp},\mathsf{ID}^{*},\mathsf{ct}^{*},k_{b}^{*})\) is a true statement or \(\mathsf{stmt}=(\mathsf{pp},\mathsf{ID}^{*},\mathsf{ct}^{*},\mathsf{k}_{b}^{*}) \in\mathcal{R}_{\mathcal{L}}\), the above simulation is identical to Game 3 from \(\mathcal{D}\)'s viewpoint. Otherwise, the above simulation is identical to Game 4. Therefore, we have  
\[|\Pr[\text{Win}_{1}]-\Pr[\text{Win}_{0}]|\leq\epsilon_{\text{CR}}.\]1  
**Lemma 4**. : _If there exists a polynomial time distinguisher \(\mathcal{D}\) between Game 5 and Game 6, then there exists a polynomial time adversary \(\mathcal{A}\) that breaks the IND-ID-CPA security of IBKEM._  
Proof. : Let \(\mathcal{D}\) be a distinguisher between Game 5 and Game 6. Then, we show how to construct \(\mathcal{A}\) that wins the IND-ID-CPA security game of IBKEM using \(\mathcal{D}\) with the same advantage. \(\mathcal{A}\) receives as input a public parameter \(\mathsf{pp}\). Then, \(\mathcal{A}\) runs \(\mathcal{D}\) by simulating Game 5 with changes as follows. In the setup phase, \(\mathcal{A}\) sends \(\mathsf{PP}=(\mathsf{pp},H_{1},H_{2})\) to \(\mathcal{D}\). * When asked a decapsulation query (CT,ID), if \(\mathsf{ID}\
eq\mathsf{ID}^{*}\), \(\mathcal{A}\) queries ID for key generation oracle of its challenger, decapsulates CT, and returns it to \(\mathcal{D}\). Otherwise, if \(\mathsf{ID}\
eq\mathsf{ID}^{*}\), the procedure is the same as in Game 3. * In the challenge phase, the distinguisher \(\mathcal{D}\) sends \(\mathsf{ID}^{*}\) to \(\mathcal{A}\). Then, \(\mathcal{A}\) sends \(\mathsf{ID}^{*}\) to its challenger and receives the challenge ciphertext and key pair. Given the pair \((\mathsf{ct}^{*},k_{b}^{*})\), \(\mathcal{A}\) sets \(\mathsf{stmt}=(\mathsf{pp},\mathsf{ID}^{*},\mathsf{ct}^{*},k_{b}^{*})\) and generates simulated proof \(\pi_{\mathsf{sim}}^{*}\) on the statement stmt. Then, \(\mathcal{A}\) randomly chooses \(\mathsf{K}^{*}\stackrel{{\mathsf{S}}}{{\leftarrow}}\{0,1\}^{\ell}\) and sends \((\mathsf{CT}^{*}=(\mathsf{ct}^{*},\pi_{\mathsf{sim}}^{*}),\mathsf{K}^{*})\) to \(\mathcal{D}\). In the guess phase, \(\mathcal{D}\) outputs its guess. If the guess is \"Game 6\", \(\mathcal{A}\) outputs 1; otherwise, it output 0.