## 5 Application
### CCA-Secure Boneh-Franklin IBKEM  
Let \(\mathsf{GGen}^{\mathsf{DBDH}}(\lambda)\) be a bilinear group generator generating a group \(\mathcal{G}=(\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},p,e)\), where the DBDH assumption [22; 23] holds. In the Boneh-Franklin IBKEM [22], public parameters consist of two group elements \((g,h)\in\mathbb{G}_{2}^{2}\) such that \(h=g^{x}\) with corresponding master secret key \(x\in\mathbb{Z}_{p}\). For an identity \(\mathsf{ID}\), the secret key is generated by computing \(\mathsf{skID}=H(\mathsf{ID})^{x}\in\mathbb{G}_{1}\). The encapsulation is done by computing \(\mathsf{ct}=g^{w}\in\mathbb{G}_{2}\) and \(\mathsf{k}=e(H(\mathsf{ID}),h)^{w}\in\mathbb{G}_{T}\), and decapsulation is done by computing \(\mathsf{k}=e(H(\mathsf{ID})^{x},\mathsf{ct})\in\mathbb{G}_{T}\). Based on this scheme, the transformed IND-CCA-secure scheme is described as follows. \begin{tabular}{l l}  & **IBKEM.Setup**(\(\lambda\)): For security parameter \(\lambda\), the setup algorithm proceeds as follows. \\  & 1. & Generate \(\mathcal{G}=(\mathbb{G}_{1},\mathbb{G}_{2},\mathbb{G}_{T},p,e)\overset{\xi}{ \leftarrow}\mathsf{GGen}^{\mathsf{DBDH}}(\lambda)\). \\  & 2. & Select a random generator \(g\in\mathbb{G}_{2}\). \\  & 3. & Select a random exponent \(x\in\mathbb{Z}_{p}\) and compute \(h=g^{x}\in\mathbb{G}_{2}\). \\  & 4. & Select hash functions \(H:\{0,1\}^{*}\rightarrow\mathbb{G}_{1}\), \(H_{1}:\{0,1\}^{*}\rightarrow\{0,1\}^{k}\subseteq\mathbb{Z}_{p}\) and \(H_{2}:\{0,1\}^{*}\rightarrow\{0,1\}^{\ell}\). \\  & 5. & Output \(\mathsf{MSK}=x\) and \(\mathsf{PP}=(\mathcal{G},g,h,H,H_{1},H_{2})\). \\  & & **IBKEM.KeyGen**(\(\mathsf{PP},\mathsf{MSK},\mathsf{ID}\)): For public parameters \(\mathsf{PP}=(\mathcal{G},g,h,H,H_{1},H_{2})\), a master secret key \(\mathsf{MSK}=x\), and an identity \(\mathsf{ID}\), the KeyGen algorithm proceeds as follows. \\  & 1. & Compute \(\mathsf{SK}_{\mathsf{ID}}=H(\mathsf{ID})^{x}\in\mathbb{G}_{1}\). \\  & 2. & Output \(\mathsf{SK}_{\mathsf{ID}}\). \\ \end{tabular}   
**IBKEM.Encap(PP,ID)**: For public parameters \(\mathsf{PP}=(\mathcal{G}\), \(g\), \(h\), \(H\), \(H_{1}\), \(H_{2})\) and an identity ID, the Encap algorithm proceeds as follows. 1. Select a random exponent \(w\in\mathbb{Z}_{p}\). 2. Compute \(Q_{\text{ID}}=e(H(ID),h)\in\mathbb{G}_{T}\). 3. Set \(\mathsf{stmt}=(g,h,\text{ID},g^{w},Q_{\text{ID}}^{w})\) and \(\mathsf{wt}=w\). 4. Compute \(\pi\leftarrow\mathcal{P}^{H_{1}}(\mathsf{stmt},\mathsf{wt})\). 1. Choose the random exponent \(r\in\mathbb{Z}_{p}\). 2. Set \(\mathsf{com}=(g^{r},Q_{\text{ID}}^{r})\in\mathbb{G}_{2}\times\mathbb{G}_{T}\). 3. Compute \(c\,=H_{1}(\mathsf{stmt},\mathsf{com})\) and \(s=r+wc\). 4. Output the proof \(\pi=(s,c)\). 5. Set \(\mathsf{K}\gets H_{2}(\mathsf{stmt},\mathsf{com},\pi)\). 6. Output \(\mathsf{K}\) and \(\mathsf{CT}=(g^{w},\pi)\). **IBKEM.Decap(PP,\(\mathsf{CT},\mathsf{SK}_{\text{ID}}\))**: For public parameters \(\mathsf{PP}=(\mathcal{G},g,h,H,H_{1},H_{2})\), a ciphertext \(\mathsf{CT}=(\mathsf{ct},\pi=(s,c))\), and a private \(\mathsf{SK}_{\text{ID}}\), the Decap algorithm proceeds as follows. 1. Compute \(\mathsf{k}=e(\mathsf{SK}_{\text{ID}},\mathsf{ct})\in\mathbb{G}_{T}\). 2. Set \(\mathsf{stmt}=(g,h,\text{ID},\mathsf{ct},\mathsf{k})\). 3. If \(1\leftarrow\mathcal{V}^{H_{1}}(\mathsf{stmt},\pi)\), go on. Otherwise, abort. 1. Compute \(Q_{\text{ID}}=e(H(\text{ID}),h)\in\mathbb{G}_{T}\). 2. Set \(\mathsf{com}=(g^{s}\cdot\mathsf{ct}^{-c},\,Q_{\text{ID}}^{r}\cdot\mathsf{k}^{ -c})\in\mathbb{G}_{2}\times\mathbb{G}_{T}\). 3. If \(c=H_{1}(\mathsf{stmt},\mathsf{com})\), output \(1\). Otherwise, output \(0\). 4. Compute \(\mathsf{K}\gets H_{2}(\mathsf{stmt},\mathsf{com},\pi)\) and output \(\mathsf{K}\). **Theorem 7**. : _Suppose that the \((t_{dblh},\epsilon_{dblh})\) DBDH assumption holds in \(\mathcal{G}\), and \(H_{1}\) and \(H_{2}\) are random oracles.