## 4 Conversion Method for CCA-Secure IBKEM
### Security Proof  
**Theorem 4**. : _Let \(H_{1}\) and \(H_{2}\) be modeled as random oracles with \(\epsilon_{\text{CR}}\)-collision resistance. Suppose that IBKEM is \((t^{\prime},e^{\prime},q^{\prime}_{\text{id}})\)-IND-ID-CPA-secure and MIZK-compatible with \(\epsilon_{\text{ZK}}\)-zero-knowledge and \(\epsilon_{\text{SS}}\)-simulation soundness. Then, the resulting IBKEM is \((t,e,q_{\text{id}},q_{\text{id}})\)-IND-ID-CCA-secure, where_  
\[e\leq 2\cdot(\epsilon_{\text{CR}}+\epsilon_{\text{ZK}}+q_{\text{d}}\cdot \epsilon_{\text{SS}}+e^{\prime})+1/|\mathcal{K}|,\,\,\,t^{\prime}\approx t+ \mathcal{O}(q_{\text{d}}t_{\text{v}}).\]  
_Here, \(t_{\text{v}}\) is the required time for verification in the NIZK and \(\mathcal{K}\) is the key space of IBKEM._  
Proof. : We consider a sequence of hybrid games Game 0,..., Game 9. Game 0 is the actual IND-ID-CCA security game, where an adversary is given a key from the encapsulation algorithm for the encapsulation query, and Game 9 is the actual IND-ID-CCA game, where an adversary is given a key randomly chosen from a key space for the encapsulation query. Let \(\text{Win}_{i}\) denote the event that \(\mathcal{A}\) wins in Game \(i\). Table 2 summarizes the games described below and the properties used to prove indistinguishability between consecutive games. **Game 0. ** This is the IND-ID-CCA security game executed with \(b=1\). Thus, the challenger always returns \((\text{CT}^{*},\text{K}^{*})=\text{IBKEM.Encap}^{\prime}(\text{PP},\text{ID}^{*})\) for the challenge. **Game 1. ** Let Coll be the event that a collision of the hash functions \(H_{1}\) or \(H_{2}\) occurs. This game is identical to Game 0 except that it aborts when the event Coll occurs during the simulation. Due to the collision resistance of the hash functions, we have  
\[|\Pr[\text{Win}_{1}]-\Pr[\text{Win}_{0}]|\leq\epsilon_{\text{CR}}.\]  
**Game 2. ** This game is identical to Game 1 except that the challenge ciphertext is computed differently. Instead of using the real proving algorithm of NIZK, the challenger generates challenge ciphertext using the simulator of NIZK (i.e., \(\text{CT}^{*}=(\text{ct}^{*},\pi^{*}_{\text{sim}})\)). Due to the non-interactive zero-knowledge property of NIZK, we have  
\[|\Pr[\text{Win}_{2}]-\Pr[\text{Win}_{1}]|\leq\epsilon_{\text{ZK}}.\]  
**Game 3. ** This game is identical to Game 2 except that the decapsulation query is operated differently. In the previous game, for a given pair \(\big{(}\text{CT}=(\text{ct},\pi=(s,c)),\text{ID}\big{)}\), the challenger runs \(\text{SK}_{\text{ID}}\xleftarrow{\text{IBKEM.KeyGen}^{\prime}}(\text{PP}, \text{MSK},\text{ID})\), computes \(\text{K}\xleftarrow{\text{IBKEM.Decap}^{\prime}(\text{PP},\text{CT},\text{SK}_{ \text{ID}})}\)and returns \(K\). In this game, if \(ID=ID^{*}\), the challenger retrieves a tuple \((stmt,com,c)\) in the \(H_{1}\) hash table such that \(c=H_{1}(stmt=(pp,ID^{*},ct,*),com=(com_{ct},*))\); then, it returns \(K=H_{2}(stmt,com,\pi)\) only when these statement \(stmt\), commitment \(com\), challenge \(c\), and response \(s\) are verified (i.e., \(1\leftarrow\mathcal{V}(stmt,com,c,s)\)). Otherwise, if \(ID\
eq ID^{*}\), it generates \(SK_{ID}\) using \(MSK\) and decapsulates the ciphertext \(CT\) using \(SK_{ID}\), as in the previous game. Note that an adversary cannot distinguish Game 3 from Game 2 unless it queries a ciphertext \(\hat{CT}=(\hat{ct},\hat{\pi}=(\hat{s},\hat{c}))\) such that proof \(\hat{\pi}\) is verified with a retrieved tuple \((stmt,com,\hat{c})\) in \(H_{1}\) (i.e., \(1\leftarrow\mathcal{V}(stmt,com,\hat{c},\hat{s})\)) and \(stmt\) is a false statement. In other words, the adversary must forge a proof \(\hat{\pi}\) for a false statement \(stmt\) to distinguish the games. Then, by the simulation soundness of \(NIZK\) with respect to \(q_{d}\) decapsulation queries, we have  
\[|\Pr[\mathsf{Win}_{3}]-\Pr[\mathsf{Win}_{2}]|\leq q_{d}\cdot \epsilon_{\SS}.\]  
**Game 4. ** This game is identical to Game 3 except that the challenge ciphertexts are computed differently.