## 4 Conversion Method for CCA-Secure IBKEM
### IBKEM
#### 4.1.2 Security Model of IBKEM  
Here, we define the IND-ID-\(\{\text{CPA},\text{CCA}\}\) security of IBKEM by referring to [12]. First, the security experiment of IND-ID-CPA played between a challenger \(\mathcal{C}\) and an adversary \(\mathcal{A}\) is described as follows. \[ \begin{array}{l}\text{{\bf Experiment}}\ \text{{\bf Exp}}_{\text{ IND-ID-CPA},\text{$\lambda$}}^{\text{IBKEM},\mathcal{A}}\\ (\text{PP},\text{MSK})\overset{\$}{\leftarrow}\text{ IBKEM.Setup}(\lambda);\\ \text{ID}^{*}\leftarrow\mathcal{A}^{\text{KeyGenO}(\cdot)}\ (\text{PP});\\ \text{$\mathcal{K}_{b}^{*}\overset{\$}{\leftarrow}\mathcal{K};(\text{$K_{b}^{* },\text{CT}^{*}$})\overset{\$}{\leftarrow}\text{ IBKEM.Encap(PP,ID^{*})};\\ \text{$b^{\prime}\leftarrow\mathcal{A}^{\text{KeyGenO}(\cdot)}\ (\text{PP},\text{CT}^{*},\text{K}_{b}^{*})$}; \\ \text{Output}\ b^{\prime}.\end{array} \] \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Game** & \(\text{K}^{*}\) & \(\text{stmt}^{*}\) & \(\text{CT}^{*}\) & \(\text{SK}\) & \(\text{DecO}(\cdot)\) & **Property** \\ \hline
0 & \(H_{2}(\text{stmt}^{*},\text{com},\text{$\pi_{\text{real}}^{*}$})\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{real}}^{*}$}\) & sk & \(\text{KEM.Decap}(\cdot)\) & - \\
1 & \(H_{2}(\text{stmt}^{*},\text{com},\text{$\pi_{\text{real}}^{*}$})\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{real}}^{*}$}\) & sk & \(\text{KEM.Decap}(\cdot)\) & CR \\
2 & \(H_{2}(\text{stmt}^{*},\text{com},\text{$\pi_{\text{sim}}^{*}$})\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{sim}}^{*}$}\) & sk & \(\text{KEM.Decap}(\cdot)\) & ZK \\
3 & \(H_{2}(\text{stmt}^{*},\text{com},\text{$\pi_{\text{sim}}^{*}$})\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{sim}}^{*}$}\) & - & RO + SS & SS \\
4 & \(H_{2}(\text{stmt}^{*},\text{com},\text{$\pi_{\text{sim}}^{*}$})\) & \((\text{pk},\text{ct}^{*},\text{k}^{\prime})\) & \(\text{ct}^{*},\text{$\pi_{\text{sim}}^{*}$}\) & - & RO + SS & IND-CPA \\
5 & \(\text{K}\overset{\$}{\leftarrow}\{0,1\}^{\ell}\) & \((\text{pk},\text{ct}^{*},\text{k}^{\prime})\) & \(\text{ct}^{*},\text{$\pi_{\text{sim}}^{*}$}\) & - & RO + SS & \(1/|\mathcal{K}|\) \\
6 & \(\text{K}\overset{\$}{\leftarrow}\{0,1\}^{\ell}\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{sim}}^{*}$}\) & - & RO + SS & IND-CPA \\
7 & \(\text{K}\overset{\$}{\leftarrow}\{0,1\}^{\ell}\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{sim}}^{*}$}\) & sk & \(\text{KEM.Decap}(\cdot)\) & SS \\
8 & \(\text{K}\overset{\$}{\leftarrow}\{0,1\}^{\ell}\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{real}}^{*}$}\) & sk & \(\text{KEM.Decap}(\cdot)\) & ZK \\
9 & \(\text{K}\overset{\$}{\leftarrow}\{0,1\}^{\ell}\) & \((\text{pk},\text{ct}^{*},\text{k}^{*})\) & \(\text{ct}^{*},\text{$\pi_{\text{real}}^{*}$}\) & sk & \(\text{KEM.Decap}(\cdot)\) & CR \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Values or operations of \(\text{K}^{*}\), \(\text{CT}^{*}\), \(\text{SK}\), and \(\text{DecO}(\cdot)\) in each game and properties ensuring the indistinguishability of consecutive games. RO + SS denotes that the simulator retrieves k from a random oracle table and checks the validity of the ciphertext based on the SS property. The oracle \(\mathsf{KeyGen}(\cdot)\) takes as input an identity ID and returns an identity secret key \(\mathsf{SK_{ID}}\stackrel{{\$}}{{\leftarrow}}\mathsf{IBKEM.KeyGen}( \mathsf{MSK},\mathsf{ID})\) with the condition that \(\mathcal{A}\) is not able to query the target identified ID\({}^{*}\). Then, the advantage of \(\mathcal{A}\) for breaking the IND-ID-CPA security of IBKEM is defined as \(\mathbf{Adv}_{\textsc{IND-ID-CPA}}^{\mathsf{IBKEM},\_4}=\Big{|}\Pr\left[1 \leftarrow\mathbf{Exp}_{\textsc{IND-ID-CPA},\lambda}^{\mathsf{IBKEM},\_4}( \lambda)\right]-\Pr\left[1\leftarrow\mathbf{Exp}_{\textsc{IND-ID-CPA},0}^{ \mathsf{IBKEM},\_4}(\lambda)\right]\Big{|}\).