Patent Description:
Cryptographic mechanisms are used in many fields to protect stored, processed, and transferred information against interceptors or eavesdroppers. Several keyed cryptographic algorithms exist. They rely on the use of secret/private information to protect data and provide confidentiality, integrity, authenticity, and non-repudiation services.

In key-based cryptographic systems, cryptographic keys are used to generate ciphertext data from original data through an encryption mechanism and to recover the original data through a decryption mechanism. The encryption mechanism uses an encryption key, while the decryption mechanism uses a decryption key. The encryption key and the decryption key may be either similar or different.

In symmetric-key cryptosystems, the encryption key and the decryption key are the same,the same cryptographic key being used for encryption of original data and decryption of plaintext. The encryption and decryption keys in symmetric-key cryptosystems represent a shared secret between the users that is used to maintain a private information link. Exemplary symmetric-key cryptosystems comprise the Diffie-Hellman key exchange method, and the AES (Advanced Encryption Standard) cryptosystems.

In public-key cryptosystems, the encryption key and the decryption key are different. More specifically, in a public-key cryptosystem, each user of the cryptosystem generates a pair of encryption key/decryption key. The encryption key, also referred to as a public key, is a public value that the user publishes/disseminates to the remaining users of the cryptosystem. The decryption key, also referred to as a private key, is secret and kept known only by the owner. Any user of a public-key cryptosystem can encrypt a message using the public key of the recipient. The encrypted message can only be decrypted with the private key of the recipient. Public-key cryptosystems allow public key encryption, ensure confidentiality, and allow digital signatures in which a message can be signed with a user's private key and verified with the user's public key. Exemplary public-key cryptosystems comprise the RSA (Rivest-Shamir-Adleman) cryptosystems.

A major challenge of public-key cryptosystems is to ensure the authenticity of public keys, which involves ensuring that a particular public key is correct,belongs to the claimed user, and has not been tampered or replaced by a malicious third party. In order to guarantee the authenticity of public keys, existing public-key cryptosystems use a public key infrastructure in which one or more certificate authorities certify ownership of public/private keys.

In "<NPL> proposed a novel type of public cryptographic schemes, referred to as 'identity-based cryptosystems'. The identity-based cryptosystems and signature schemes enable a secure communication of message and verification of signatures between the users of a cryptosystem without exchanging private or public keys. Such cryptosystems comprise a center referred to as a 'trusted center' or a 'public-key generation center' and rely on the use of an identity information that uniquely identifies each user in the cryptosystem to generate a public/private key common to each user. The role of the trusted center is to give to each user a private key when the user first joins the system. During a setup step, the trusted center determines, from a given security parameter, global system parameters and a secret master key. The global system parameters are then made public to all the users. Then, during a key generation step, the trusted center receives the identity information of each user, computes a private key in association with the identity information, and sends to each user his private key. The trusted computes the private keys of all the users in the system using the global system parameters and the secret master key it previously determined from the security parameter. Messages are encrypted by the users using the global system parameters and the identity information of the receiver of the encrypted message, used as a public key. Encrypted messages are decrypted using the global system parameters and the private key associated with the identity information that was used in the encryption step as encryption key.

Several identity-based cryptographic schemes have been developed, including:.

The security of identity-based cryptosystems depends on the security of the cryptographic functions implemented to determine the private keys, on the secrecy of the information stored at the trusted center (e.g. the master key, the private keys of the users), the identity checks performed by the trusted center before delivering private keys to the users based on their identity information, and on the actions taken by the users to safely hold their private keys and prevent their loss, duplication, or unauthorized access/use.

In existing identity-based encryption schemes, the trusted center knows all the private keys of all the users since it determined the private keys from each identity information associated with each user. The knowledge of the private keys allows the trusted center to completely decrypt any encrypted message. This problem is known as the key escrow problem. If an attacker recovers the master key that the trusted center uses to determine the private keys from the identity information associated with each user, the attacker can have access to each sent message. If a corruption of the master key occurs, then the trusted center must generate another master key and must re-compute and re-distribute all the private keys for all the users in the system.

There is accordingly a need for securing identity-based cryptosystems against the key escrow problem and more generally, there is a need for developing secured identity-based cryptosystems.

Advantageously, the embodiments of the invention enable resolving the key escrow problem, the trusted center having no access to the messages sent between the users and having only access to partial private keys of the users.

Advantageously, the embodiments of the invention enable assuring the forward secrecy between the users and the protection of the messages sent and to be sent between the users against any corruption occurring on the master key hold by the trusted center.

Advantageously, the identity-based cryptosystem according to the embodiments of the invention provide and guarantee data confidentiality between the users and authentication of the users that the identity of each sender and each recipient can be verified.

Further advantages of the present invention will become clear to the skilled person upon examination of the drawings and detailed description. It is intended that any additional advantages be incorporated herein.

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various embodiments of the invention and, together with the general description of the invention given above, and the detailed description of the embodiments given below, serve to explain the embodiments of the invention.

Embodiments of the invention provide devices and methods for secured, confidential, and authenticated exchange of messages between a pair of users, comprising a sender (also referred to herein as a 'transmitter', a `sender device' or a 'transmitter device') and a recipient (also referred to hereinafter as a 'receiver', a 'recipient device' or a 'receiver device'), in an identity-based encryption cryptosystem (also referred to as a 'cryptographic system').

Referring to <FIG>, there is shown a cryptosystem <NUM> in which the embodiments of the invention may be applied. The cryptosystem <NUM> may comprise a sender <NUM> and a recipient <NUM> connected via a link <NUM> and a trusted center <NUM>.

The sender <NUM> and the recipient <NUM> may be any user, user device, equipment, object, entity, configured to operate in the cryptosystem <NUM>. More specifically, the sender <NUM> may be any user device, user equipment, user object, or user apparatus configured or configurable to determine an encrypted message from original data and to transmit the encrypted message to the recipient <NUM>. The recipient <NUM> may be any user device, user equipment, user object, or user apparatus configured or configurable to receive the encrypted message transmitted over the link <NUM> and to decrypt the encrypted message to recover original data. It should be noted that in the figures, the sender <NUM> and the recipient <NUM> are labeled according to the direction of transmission and reception of encrypted messages. However, in practice, the sender <NUM> and the recipient <NUM> may be any transceivers devices capable of transmitting and receiving data in any cryptosystem <NUM>.

In some embodiments, the sender <NUM> and the recipient <NUM> may be any cryptographic device that implement hardware and/or software cryptographic functions for ensuring data and/or signals security, encryption, authentication, protection, and privacy. As used herein, a 'cryptographic device' encompasses any device, computer, computing machine, or embedded system, programmed and/or programmable to perform cryptographic functions for the generation and the use of cryptographic keys. Exemplary cryptographic devices include, without limitation:.

The embodiments of the invention may be applied in any a cryptosystem <NUM>, which may be used in different applications in storage, information processing, or communication systems.

For example, in an application of the invention to storage systems, the cryptosystem <NUM> may represent a storage system, infrastructure, or network, the sender <NUM> and/or the recipient <NUM> being part of such cryptosystem and comprising one or more storage devices configured to store oruse encrypted data (e.g. memory cards or hard discs).

In an application of the invention to information processing, the cryptosystem <NUM> may be for example a computer system (e.g. a small or large area wired or wireless access network), a database, an online sale system or a financial system comprising a sender <NUM> and a recipient <NUM> configured to secure the data used and/or stored in the system (such as personal financial or medical data).

In an application of the invention to communication systems, the cryptosystem <NUM> may be wired/wireless/optical/radio communication network in which at least one sender <NUM> is configured to transmit, over a medium <NUM> that can be unsecure, encrypted data to at least one recipient <NUM>.

Original data may correspond to text files, video, audio, or any other media data.

The sender <NUM> and/or the recipient <NUM> may be fixed such as a computer operating in a wired communication system, or mobile, such as a user terminal operating in a radio or wireless network.

The link <NUM> may correspond to a network (e.g. Internet-based network, computer network) or to any communication medium (wired, wireless, or optical).

The sender <NUM> and the recipient <NUM> may be configured to select the trusted center <NUM> in the cryptosystem <NUM> and to identify the trusted center by its identity information. The sender <NUM> may be further configured to select the recipient <NUM> among the users of the cryptosystem <NUM>.

The trusted center <NUM> may be connected to the sender <NUM> and the recipient <NUM>. The trusted center <NUM> may be a device, an entity, or a system such as an organization (e.g. a social public organization, headquarters of a corporation) configured or configurable to generate private keys associated with the identity information of the users when they join the cryptosystem <NUM>.

According to some embodiments, the trusted center <NUM> may be a system administrator, a dedicated server, or a server that is part of a distributed network.

Each user in the cryptosystem <NUM> may be associated with an identity information, also referred to as 'an identifier', that uniquely identifies the user in the cryptosystem <NUM>. In some embodiments, an identifier may be one or a combination of two or more identifiers chosen in a group comprising an identity sequence, a name, a username, a network address, a social security number, a street address, an office number, a telephone number, an electronic mail address associated with a user, a date, an Internet Protocol address belonging to a network host. An identifier associated with each user may be any public, cryptographically unconstrained string that is used in conjunction with public data of the trusted center <NUM> to perform data encryption or signing.

In the following description of some embodiments, the identity information associated with the sender <NUM> will also be referred to the 'sender identifier' or 'transmitter identifier', the identity information associated with the recipient <NUM> will be referred to as the 'recipient identifier' or 'receiver identifier', and the identity information associated with the trusted center will be also referred to as the 'trusted center identifier'.

Each of the sender identifier, the recipient identifier, and the trusted center identifier may be strings that belong to the set {<NUM>,<NUM>}`.

In order to facilitate the understanding of the various embodiments of the invention, the following definitions are provided:.

The embodiments of the invention provide a sender <NUM> operable to transmit an encrypted message C(M) to a recipient <NUM> in an identity-based cryptosystem <NUM> that comprises a trusted center <NUM>, the sender <NUM> and the recipient <NUM> being configured to communicate over the link <NUM> securely, independently, and without accessing the trusted center <NUM>. Accordingly, the transmission of encrypted messages from the sender <NUM> to the recipient <NUM> may be completed without contacting the trusted center <NUM>. In the identity-based cryptosystem <NUM>, the sender <NUM> is associated with a sender identifier IDsend and the recipient is associated with a recipient identifier IDreci, and both the sender <NUM> and the recipient <NUM> are connected to the trusted center <NUM>.

The trusted center <NUM> may be configured to initiate the setup of the cryptosystem <NUM> and to manage the generation and distribution of the private keys of the users including the sender <NUM> and the recipient <NUM>. Accordingly, the trusted center <NUM> may be configured to receive the sender identifier IDsend from the sender <NUM> and the recipient identifier IDreci from the recipient <NUM> and to determine a sender partial private key Prvsend from the sender identifier IDsend and a recipient partial private key Prvreci from the recipient identifier IDreci. The trusted center <NUM> has accordingly only access to a part of the private keys of the sender <NUM> and the recipient <NUM>. The trusted center <NUM> may be further configured to distribute the partial private keys, i.e. to send the sender partial private key to the sender <NUM> and to send the recipient partial private key to the recipient <NUM>. Once the trusted center <NUM> delivered the partial private keys to the sender <NUM> and the recipient <NUM>, the sender partial private key and the recipient partial private key may not need to be updated, for example if new users join the cryptosystem <NUM>. The trusted center <NUM> may be closed after the sender and recipient partial private keys are issued and the cryptosystem <NUM> may continue to operate in a completely decentralized manner for an indefinite period.

According to the embodiments of the invention, the sender <NUM> may be configured to send the encrypted message using two exchange steps with the recipient <NUM> that involve the use and authentication of two additional public session keys, pub<NUM> and pub<NUM>.

Accordingly, the sender <NUM> may be configured to send a request to the recipient <NUM> asking for two public session keys pub<NUM> and pub<NUM>.

Upon reception of the two public session keys request sent from the sender <NUM>, the recipient <NUM> may be configured to determine a private session key sk and two public session keys pub<NUM> and pub<NUM> from the recipient partial private key Prvreci and system parameters denoted by PK and to determine a first ciphertext set denoted by C<NUM> from encryption and authentication of the two public keys pub<NUM> and pub<NUM>. The sender <NUM> may be configured to receive the first ciphertext set from the recipient <NUM>.

After receiving the first ciphertext set C, the sender <NUM> may be configured to decrypt and authenticate the two public session keys from the first ciphertext set denoted by C<NUM> using the recipient identifier IDreci and the sender partial private key Prvsend.

The operations performed so far by the sender <NUM> enable providing two public session keys pub<NUM> and pub<NUM> to the sender <NUM>, the two public session keys being securely and authentically sent from the recipient <NUM>.

Now, the sender <NUM> operates in the second phase of the exchange of data to securely and authentically send the encrypted message C(M) to the recipient <NUM>.

Accordingly, the sender <NUM> may be configured to determine a second ciphertext set denoted by C<NUM> from the sender partial private key Prvsend, the recipient identifier IDreci and the two public keys pub<NUM> and pub<NUM>, the second ciphertext set comprising an encrypted message C(M).

The sender <NUM> may be configured to send the second ciphertext set C<NUM> to the recipient <NUM>, the recipient <NUM> being configured to recover the original message M by decrypting the encrypted message C(M) comprised in the received second ciphertext set and authenticating the sender <NUM>.

The trusted center <NUM> has secret information that enables it to compute the partial private keys of all the users in the cryptosystem <NUM>. More specifically, the trusted center <NUM> may be configured to hold a security parameter denoted by <MAT> and a trusted center identifier IDTC and to generate system parameters PK and a master private key (also referred to as a 'master secret key') s from the security parameter λ and the trusted center identifier IDTC. The system parameters denoted by PK = {p,G,GT,e,H<NUM>,H<NUM>,H<NUM>,gpub} comprise a prime number p, two algebraic groups G and GT of order equal to the prime number p, an admissible bilinear map e, a first cryptographic hash function H<NUM>, a second cryptographic hash function H<NUM>, a third cryptographic hash function H<NUM>, and a trusted center public key gpub associated with the trusted center identifier IDTC.

When computed, the trusted center <NUM> makes the system parameters known publicly, i.e. to all the users in the cryptosystem including the sender <NUM> and the recipient <NUM>. The trusted center <NUM> keeps, however, the master private key sk private and known only to the trusted center <NUM>.

The security parameter λ is used to determine the system parameters and the master private key. In particular, the security parameter may allow to determine the size, in bits, of the master private key such that <MAT>, with n being a non-zero natural number. The security parameter may be also used to determine the size of the prime number in bits. For example, the prime number may be selected to be a random λ-bits prime number.

According to some embodiments, the bilinear map e may be based on a Weil pairing or a Tate pairing defined on a subgroup of an elliptic curve. In such embodiments, the elements of the algebraic group G may be points on an elliptic curve.

According to some embodiments, the trusted center <NUM> may be configured to determine the system parameters and the master private key by applying a setup algorithm that takes as input the security parameter λ and the trusted center identifier IDTC and returns as outputs the system parameters PK and a master private key sk. According to the setup algorithm, the trusted center <NUM> may be configured to generate a prime number p, the two algebraic groups G and GT and an admissible bilinear map e by running a Bilinear Diffie-Hellman parameter generator that takes as input the security parameter λ and outputs a prime number p, the description of two groups G and GT and the description of an admissible bilinear map e:G×G → GT.

Given the security parameter, the trusted center <NUM> may be configured to select, among a predefined set of cryptographic hash functions, a first cryptographic hash function H<NUM>: {<NUM>,<NUM>}n → G, a second cryptographic hash function H<NUM>: GT → {<NUM>,<NUM>}n, and a third cryptographic hash function <MAT>. The cryptographic hash function H<NUM>,H<NUM> and H<NUM> may be random oracles.

The trusted center <NUM> may be then configured to determine a first value denoted by g by applying the first cryptographic hash function H<NUM> to the trusted center identifier IDTC such that g = H<NUM>(IDTC).

The trusted center <NUM> may be further configured to randomly select a master secret key <MAT> and to determine a trusted center public key gpub by applying an exponentiation function defined by a base and an exponent, the base being equal to the first value g, and the exponent being equal to the master private key s such that gpub = gs.

In embodiments in which the first value g corresponds to a point of an elliptic curve, the exponentiation function may be reduced to a scalar multiplication function according to which the trusted center public key gpub is determined according to gpub = [s]g.

The sender <NUM> and the recipient <NUM> may ask the trusted center <NUM> to send them their partial private keys. The sender <NUM> may send the sender identifier IDsend to the trusted center <NUM> and ask it to receive the sender partial private key Prvsend. The recipient <NUM> may send the recipient identifier IDreci to the trusted center <NUM> and ask it to receive the recipient partial private key Prvreci. Upon reception of the requests sent by the sender <NUM> and the recipient <NUM>, the trusted center <NUM> may be configured to determine the sender partial private key and the recipient partial private key from the master secret key s, the system parameters PK, and the sender identifier IDsend and the recipient identifier IDreci by applying a KeyGen1 algorithm that takes as input the master secret key, the sender identifier, the recipient identifier, and the system parameters, and outputs the sender partial private key and the recipient partial private key. Accordingly, the trusted center <NUM> may be configured to determine a sender public key gsend by applying the first hash function H<NUM> to the sender identifier IDsend such that gsend = H<NUM>(IDsend) and to determine the sender partial private key Prvsend by applying an exponentiation function defined by a base and an exponent, the base being equal to the sender public key gsend, and the exponent being equal to the inverse of the master secret key <MAT> such that <MAT>. In embodiments in which the sender public key corresponds to a point of an elliptic curve, the exponentiation function may be replaced with a scalar multiplication function according to which Prvsend = <MAT>Prvsend.

Similarly, the trusted center <NUM> may configured to determine a recipient public key greci by applying the first hash function H<NUM> to the recipient identifier IDreci such that greci = H<NUM>(IDreci) and to determine the recipient partial private key Prvreci by applying an exponentiation function defined by a base and an exponent, the base being equal to the recipient public key greci, and the exponent being equal to the inverse of the master secret key <MAT> such that <MAT>. In embodiments in which the recipient public key corresponds to a point of an elliptic curve, the exponentiation function may be replaced with a scalar multiplication function according to which <MAT>.

According to the embodiments of the invention, the sender <NUM> encrypts an original message M and sends the encrypted message C(M) to the recipient <NUM> using public session keys that are determined by the recipient <NUM>.

According to some embodiments, before determining the public session keys pub<NUM> and pub<NUM>, the recipient <NUM> may be configured to verify the trusted center public key gpub using the recipient partial private key Prvreci. The recipient <NUM> may be configured to determine a private session key sk, the two public session keys pub<NUM> and pub<NUM>, and a first ciphertext set C<NUM> if a verification condition is satisfied by applying a KenGen2 algorithm that takes as inputs the recipient partial private key and the system parameters and outputs a private session key and two public session keys. The verification condition may be satisfied if the recipient <NUM> determines that a first value e(Prvreci,gpub) is equal to a second value e(H<NUM>(IDreci),H<NUM>(IDTC)), the first value being determined by the application of the bilinear map e to the recipient partial private key Prvreci and to the trusted center public key gpub, the second value being determined by the application of the bilinear map e to the output H<NUM>(IDreci) of the first cryptographic hash function H<NUM> applied to the recipient identifier IDreci and to the output H<NUM>(IDTC) of the first cryptographic hash function H<NUM> applied to the trusted center identifier IDTC. If the verification condition is satisfied, i.e. if the recipient <NUM> determines that e(Prvreci,gpub) = e(H<NUM>(IDreci)H<NUM>(IDTC)), then the recipient <NUM> computes a private session key and two public session keys. If the verification condition is not satisfied, i.e. if the recipient <NUM> determines that e(Prvreci,gPub) ≠ e(H<NUM>(Dreci),H<NUM>(IDTC)), then the recipient <NUM> aborts and does not compute the private and public session keys.

In embodiments in which the verification condition e(Prvreci,gpub) = e(H<NUM>(IDreci),H<NUM>(IDTC)) is satisfied, the recipient <NUM>, according to the KeyGen2 algorithm, may be configured to determine a random value denoted by β and to determine a private session key sk by applying an exponentiation function of a base equal to the recipient partial private key Prvreci and an exponent equal to the random value f3 such that <MAT>. In embodiments in which the recipient partial private key Prvreci corresponds to a point of an elliptic curve, the exponentiation function may be reduced to a scalar multiplication function according to which the private session key sk is determined according to sk = [β] Prvreci. In such embodiments, the exponent is a scalar value.

The recipient <NUM> may be further configured to determine the two public session keys comprising a first public session key pub<NUM> and a second public session key pub<NUM> by applying exponentiation function. More specifically, the recipient <NUM> may be configured to determine the first public session key pub<NUM> by applying an exponentiation function of a base equal to the output H<NUM>(IDTC) of the application of the first cryptographic hash function H<NUM> to the trusted center identifier IDTC and an exponent equal to the random value β such that pub<NUM> = (H<NUM>(IDTC))β. In embodiments in which the output H<NUM>(IDTC) corresponds to a point of an elliptic curve, the exponentiation function may be replaced by a scalar multiplication according to which pub<NUM> = [β]H<NUM>(IDTC).

The recipient <NUM> may be configured to determine the second public session key pub<NUM> by applying an exponentiation function of a base equal to the trusted center public key gpub and an exponent equal to the random value f3 such that <MAT>. In embodiments in which the trusted center public key gpub corresponds to a point of an elliptic curve, the exponentiation function may be reduced to a scalar multiplication function according to which the second public session key pub<NUM> is determined according to pub<NUM> = [β]gpub. In such embodiments, the exponent f3 is a scalar value.

The private session key sk may be used for the conversation between the sender <NUM> and the recipient <NUM>, i.e. the exchange of encrypted messages. The two public session keys may be used to authenticate the sender <NUM> and the recipient <NUM>.

After generating the public session keys, the recipient <NUM> may be configured to determine a first ciphertext set C<NUM> to be sent to the sender <NUM> to communicate the public session keys in an encrypted and authenticated way by applying an Encrypt1 algorithm that takes as inputs the sender identifier, the sender partial private key, the recipient identifier, the two public session keys and the system parameters, and outputs a first ciphertext set. The first ciphertext set C<NUM> = {V<NUM>,U<NUM>,W<NUM>,W<NUM>,Y<NUM>} comprises a first ciphertext V<NUM>, a second ciphertext U<NUM>, a third ciphertext W<NUM>, a fourth ciphertext W<NUM>, and a fifth ciphertext Y<NUM>. The recipient <NUM> may be configured to first verify the trusted center public key using the recipient partial private key by checking if the verification condition e(Prvreci,gpub) = e(H<NUM>(IDreci),H<NUM>(IDTC)) is satisfied. If the recipient <NUM> determines that the verification condition is satisfied, then it generates the first ciphertext set C<NUM>. If the recipient <NUM> determines that the verification condition is not satisfied, i.e. that e(Prvreci,gpub) ≠ e(H<NUM>(IDreci)H<NUM>(IDTC)), then the recipient <NUM> aborts and does not compute the first ciphertext set.

In embodiments in which the verification condition is satisfied, i.e. when the recipient <NUM> determines e(Prvreci,gpub) = e(H<NUM> (IDreci),H<NUM>(IDTC)), the recipient <NUM> may be configured, according to the Encrypt1 algorithm, to randomly generate a random secret key denoted by σ, to determine a sender public key gsend = H<NUM>(IDsend) by applying the first cryptographic hash function H<NUM> to the sender identifier IDsend, and to determine a first intermediate value denoted by r = H<NUM>(σ, pub<NUM>,pub<NUM>) by applying the third cryptographic hash function H<NUM> to the random secret key σ, the first public session key pub<NUM>, and to the second public session key pub<NUM>. The recipient <NUM> may be further configured to:.

The encryption of the public session keys by the recipient <NUM> is not performed to guarantee the data confidentiality, but it is performed to make more difficult the modification of the public session keys during its transfer over the link <NUM> potentially unsecure, from the recipient <NUM> to the sender <NUM>.

According to some embodiments, upon reception of the first ciphertext set C<NUM> from the recipient <NUM>, the sender <NUM> may be configured to verify the identity of the recipient and to decrypt the two public session keys by applying a Decrypt1 algorithm that takes as inputs the sender identifier, the sender partial private key, the recipient identifier, the first ciphertext set and the system parameters and outputs decrypted two public session keys. Accordingly, the sender <NUM> may be configured to:.

The sender <NUM> may be configured to verify the recipient identity by checking a verification condition, the verification condition being satisfied if the sender <NUM> determines that the fifth ciphertext Y<NUM> is equal to the output H<NUM>((e(Prvsend,greci))r) of the application of the second cryptographic hash function H<NUM> to an input value (e(Prvsend,greci))r, the input value being given by the output e(Prvsend,greci) of the application of the bilinear map e to the sender partial private key Prvsend and the recipient public key greci to the power the recovered intermediate value r. Accordingly, the verification condition is satisfied if the sender <NUM> determines that Y<NUM> = H<NUM>((e(Prvsend,greci))r). If the sender <NUM> determines that the verification condition Y<NUM> = H<NUM>((e(Prvsend,greci))r) is not satisfied, then the sender <NUM> aborts.

According to the embodiments of the invention, the sender <NUM> is configured to send an encrypted message C(M) to the recipient <NUM>. The sender <NUM> may be configured to determine the encrypted message C(M) by encrypting an original message M ∈ <IMG> using the two public keys such that the encrypted message is sent to the recipient <NUM> as a part of a second ciphertext set denoted by C<NUM> according to an Encrypt2 algorithm that takes as inputs the recipient identifier, the sender partial private key, the sender identifier, a given message M and the two public session keys, and outputs the second ciphertext set. According to the Encrypt2 algorithm, the sender <NUM> may be configured to determine the second ciphertext set C<NUM> if the sender <NUM> checks that two verification conditions are satisfied, the two verification conditions comprising a trusted center identity verification condition and a public session keys verification condition. The trusted center identity verification condition is satisfied if the sender <NUM> determines that e(Prvsend,gpub) = e(H<NUM>(IDsend),H<NUM>(IDTC)) this means that if the sender <NUM> determines that the output e(Prvsend,gpub) of the application of the bilinear map e to the sender partial private key Prvsend and the trusted center public key gpub is equal to the output e(H<NUM>(IDsend),H<NUM>(IDTC)) of the application of the bilinear map e to the result H<NUM>(IDsend) of the application of the first cryptographic hash function H<NUM> to the sender identifier IDsend and to the result H<NUM>(IDTC) of the application of the first cryptographic hash function H<NUM> to the trusted center identifier IDTC. The public session keys verification condition is satisfied if the sender <NUM> determines that e(pub<NUM>,H<NUM>(IDsend)) = e(pub<NUM>,Prvsend), i.e. if the sender <NUM> determines that the output e(pub<NUM>,H<NUM>(IDsend)) of the application of the bilinear map e to the first public session key pub<NUM> and to the result H<NUM>(IDsend) of the application of the first cryptographic hash function H<NUM> to the sender identifier IDsend is equal to the output e(pub<NUM>,Prvsend) of the application of the bilinear map e to the second public session key pub<NUM> and to sender partial private key Prvsend.

The sender <NUM> verifies the trusted center public key using the sender partial private key and verifies the two public session keys. If one of the identity authentications, i.e. one of the two verification conditions, is not satisfied, then the sender <NUM> aborts.

In embodiments, in which the sender <NUM> verifies successfully the trusted center public key and the two public session keys, the sender <NUM> may be configured to determine the second ciphertext set C<NUM> = {V,U,C(M),Y}, that comprises, in addition to the encrypted message C(M), a first component denoted by V, a second component denoted by U, and a third component denoted by Y. The sender <NUM> may be configured to:.

Upon receiving the second ciphertext set C<NUM> from the sender <NUM>, the recipient <NUM> may be configured to verify the sender identity and to recover the original message M by applying a Decrypt2 algorithm that takes as inputs the private session key, the recipient partial private key, the sender identifier, the second ciphertext set and the system parameters, and outputs a recovered original message. Accordingly, the recipient <NUM> may be configured to:.

According to some embodiments, the recipient <NUM> may be further configured to verify the identity of the sender by checking if a sender identity verification condition is satisfied, the sender identity verification condition being satisfied if the recipient <NUM> determines that Y = H<NUM>((e(gsend,Prvreci))r) i.e. if the recipient <NUM> determines that the third component Y comprised in the received second ciphertext set C<NUM> is equal to the output H<NUM>((e(gsend,Prvreci))r) of the application of the second cryptographic hash function H<NUM> to an output result e(gsend,Prvreci) to the power the auxiliary value r, the output result being determined by the application of the bilinear map e to the sender public key gsend and the recipient partial private key Prvreci.

According to some embodiments, the cipher/decipher Eσ/Dσ may be any symmetric encryption/decryption algorithm/protocol/function such as the AES, the Triple Data Encryption algorithm, the DES (Data Encryption Standard), the Triple DES (3DES), or the RC4 (Rivest Cipher <NUM>). The cipher/decipher Eσ/Dσ may be configured to perform encryption/decryption using non-tweakable or tweakable modes of operation. Exemplary non-tweakable modes of operations comprise the Electronic Codebook mode (ECB), the Cipher Block Chaining mode (CBC), the Propagating Cipher Block Chaining mode (PCBC), the Cipher Feedback mode (CFB), the Output Feedback mode (OFB), and the Counter mode (CTR). Exemplary tweakable modes of operation comprise the XOR-Encrypt-XOR (XEX) mode and the tweakable with ciphertext stealing mode (XTS).

According to some embodiments, the sender <NUM> and/or the recipient <NUM> may be configured to generate the secret key used in the cipher algorithm and the decipher algorithm using a random number generator and/or Physically Unclonable Functions. In some embodiments, a random number generator may be chosen in a group comprising a pseudo-random number generator and a true random number generator.

There is also provided a method for sending an encrypted message M(C) from a sender <NUM> to a recipient <NUM> in an identity-based cryptosystem. The cryptosystem comprises a trusted center <NUM> connected to the sender <NUM> and the recipient <NUM>. In the identity-based cryptosystem <NUM>, the sender <NUM> is associated with a sender identifier IDsend and the recipient is associated with a recipient identifier IDreci.

<FIG> is a flowchart depicting a method for sending the encrypted message from the sender <NUM> to the recipient <NUM> according to some embodiments of the invention.

At step <NUM>, system parameters PK = {p,G,GT,e,H<NUM>,H<NUM>,H<NUM>,gpub} and a master private key s may be determined at the trusted center <NUM> from a security parameter λ and the trusted center identifier IDTC according to a Setup algorithm.

At step <NUM>, a sender partial private key Prvsend may be determined at the trusted center <NUM> from the sender identifier IDsend and a recipient partial private key Prvreci may be determined at the trusted center <NUM> from the recipient identifier IDreci, the sender and the recipient partial private keys may be determines according to a KeyGen1 algorithm. Step <NUM> may comprise distributing the partial private keys, i.e. sending the sender partial private key to the sender <NUM> and sending the recipient partial private key to the recipient <NUM>.

At step <NUM>, a request for two public session keys may be sent from the sender <NUM> to the recipient <NUM>.

At step <NUM>, a private session key sk and two public session keys pub<NUM> and pub<NUM> may be determined at the recipient <NUM> according to a KeyGen2 algorithm.

At step <NUM>, a first ciphertext set may be determined at the recipient <NUM> and sent to the sender <NUM>, the first ciphertext set being determined from encryption and authentication of the two public keys pub<NUM> and pub<NUM> according to an Encrypt1 algorithm.

At step <NUM>, the first ciphertext set may be received at the sender <NUM> and the two public keys may be decrypted and authenticated at the sender <NUM> using the recipient identifier IDreci and the sender partial private key Prvsend according to a Decrypt1 algorithm.

At step <NUM>, a second ciphertext set may be computed at the sender <NUM> and sent to the recipient <NUM> according to an Encrypt2 algorithm, the second ciphertext set comprising an encrypted message and being determined from the sender partial private key Prvsend, the recipient identifier IDreci and the two public keys pub<NUM> and pub<NUM>.

At step <NUM>, an original message M may be recovered at the recipient from the received second ciphertext set and the sender <NUM> may be authenticated according to a Decrypt2 algorithm.

<FIG> is a flowchart depicting a method of determining system parameters PK = {p,G,GT,e,H<NUM>,H<NUM>,H<NUM>,gpub} and a master private key s according to a Setup algorithm, the system parameters comprising a prime number p, two algebraic groups G and GT of order equal to the prime number p, an admissible bilinear map e, a first cryptographic hash function H<NUM>, a second cryptographic hash function H<NUM>, a third cryptographic hash function H<NUM>, and a trusted center public key gpub associated with the trusted center identifier IDTC.

At step <NUM>, input parameters of the setup algorithm may be received, including a security parameter denoted by <MAT> and a trusted center identifier IDTC.

At step <NUM>, a prime number p, two algebraic groups G and GT and an admissible bilinear map e may be determined by running a Bilinear Diffie-Hellman parameter generator that takes as input the security parameter λ and outputs a prime number p, the description of two groups G and GT and the description of an admissible bilinear map e: G × G → GT.

At step <NUM>, a first cryptographic hash function H<NUM>: {<NUM>,<NUM>}n → G, a second cryptographic hash function H<NUM>. GT → {<NUM>,<NUM>}n, and a third cryptographic hash function <MAT> may be selected, for example among a predefined set of cryptographic hash functions. The cryptographic hash function H<NUM>,H<NUM> and H<NUM> may be random oracles.

At step <NUM>, a first value g may be determined by applying the first cryptographic hash function H<NUM> to the trusted center identifier IDTC such that g = H<NUM>(IDTC).

At step <NUM>, a master secret key <MAT> may be selected randomly.

At step <NUM>, a trusted center public key gpub may be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the first value g, and the exponent being equal to the master private key sk such that gpub = gs. In some embodiments in which the first value g corresponds to a point of an elliptic curve, the exponentiation function may be reduced to a scalar multiplication function according to which the trusted center public key gpub is given by the product of the first value and the scalar s according to gpub = [s]g.

At step <NUM>, the system parameters PK = {p,G,GT,e,H<NUM>,H<NUM>,H<NUM>,gpub} and the master secret key s may be output. The system parameters may be disseminated to the sender <NUM> and the recipient <NUM>, while the master secret key may be kept secret at the trusted center <NUM>.

<FIG> is a flowchart depicting a method for determining a sender partial private key Prvsend and a recipient partial private key Prvreci according to the KeyGen1 algorithm. This algorithm is executed by the trusted center <NUM>.

At step <NUM>, the inputs of the KeyGen1 algorithm may be received, including the master secret key s, the system parameters PK, the sender identifier IDsend, and the recipient identifier IDreci.

At step <NUM>, a sender public key gsend may be by applying the first hash function H<NUM> to the sender identifier IDsend such that gsend = H<NUM>(IDsend).

At step <NUM>, a sender partial private key Prvsend may be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the sender public key gsend , and the exponent being equal to the inverse of the master secret key <MAT> such that <MAT>. In embodiments in which the sender public key corresponds to a point of an elliptic curve, the exponentiation function may be replaced with a scalar multiplication function according to which <MAT>.

At step <NUM>, a recipient public key greci may be determined by applying the first hash function H<NUM> to the recipient identifier IDreci such that greci = H<NUM>(IDreci).

At step <NUM>, a recipient partial private key Prvreci may be determined by applying an exponentiation function defined by a base and an exponent, the base being equal to the recipient public key greci , and the exponent being equal to the inverse of the master secret key <MAT> such that <MAT>. In embodiments in which the recipient public key corresponds to a point of an elliptic curve, the exponentiation function may be replaced with a scalar multiplication function according to which <MAT>.

At step <NUM>, the sender partial private key and the recipient partial private key may be output. In particular, the sender partial private key may be sent to the sender <NUM> and the recipient partial private key may be sent to the recipient <NUM>.

<FIG> is a flowchart depicting a method for determining a private session key sk and two public session keys pub<NUM> and pub<NUM> according to the KenGen2 algorithm. This algorithm is executed by the recipient <NUM>.

At step <NUM>, the inputs of the KeyGen2 algorithm may be received, including the recipient partial private key Prvreci and the system parameters PK.

At step <NUM>, a verification condition may be checked. The verification condition may compare a first value e(Prvreci,gpub) to a second value e(H<NUM>(IDreci)H<NUM>(IDTC)), the first value being determined previously at step <NUM> by the application of the bilinear map e to the recipient partial private key Prvreci and to the trusted center public key gpub, and the second value being previously determined, at step <NUM>, by the application of the bilinear map e to the output H<NUM>(IDreci) of the first cryptographic hash function H<NUM> applied to the recipient identifier IDreci and to the output H<NUM>(IDTC) of the first cryptographic hash function H<NUM> applied to the trusted center identifier IDTC.

If it is determined at step <NUM> that the verification condition is not satisfied, then the processing may be end at step <NUM>.

If is determined at step <NUM> that the verification condition is satisfied, then steps <NUM> to <NUM> may be performed to determine a private session key and two public session keys.

At step <NUM>, a random value denoted by f3 may be determined.

At step <NUM>, a private session key sk may be determined by applying an exponentiation function of a base equal to the recipient partial private key Prvreci and an exponent equal to the random value f3 such that <MAT>. In embodiments in which the recipient partial private key corresponds to a point of an elliptic curve, the exponentiation function may be replaced by a scalar multiplication function according to which the private session key is given by sk = [β]Prvreci.

At step <NUM>, a first public session key pub<NUM> may be determined by applying an exponentiation function of a base equal to the output H<NUM>(IDTC) of the application of the first cryptographic hash function H<NUM> to the trusted center identifier IDTC and an exponent equal to the random value f3 such that pub<NUM> = (H<NUM>(IDTC))β. In embodiments in which the output H<NUM>(IDTC) corresponds to a point of an elliptic curve, the exponentiation function may be replaced by a scalar multiplication according to which pub<NUM> = [β]H<NUM>(IDTC), β being a scalar. At step <NUM>, a second public session key pub<NUM> may be determined by applying an exponentiation function of a base equal to the trusted center public key gpub and an exponent equal to the random value f3 such that <MAT>. In embodiments in which the trusted center public key gpub corresponds to a point of an elliptic curve, the exponentiation function may be reduced to a scalar multiplication function according to which the second public session key pub<NUM> is determined according to pub<NUM> = [β]gpub. In such embodiments, the exponent f3 is a scalar value.

At step <NUM>, the private session key and the two public keys may be output.

<FIG> is a flowchart depicting a method for determining a first ciphertext set according to the Encrypt1 algorithm, the first ciphertext set C<NUM> = {V<NUM>,U<NUM>,W<NUM>, W<NUM>, Y<NUM>} comprising a first ciphertext V<NUM>, a second ciphertext U<NUM>, a third ciphertext W<NUM>, a fourth ciphertext W<NUM>, and a fifth ciphertext Y<NUM>. This algorithm is executed by the recipient <NUM>.

At step <NUM>, input parameters of the Encrypt1 algorithm may be received, including the sender identifier IDsend, the sender partial private key Prvsend, the recipient identifier IDreci, the two public session keys pub<NUM> and pub<NUM> and the system parameters PK.

At step <NUM>, a verification condition may be checked verify the trusted center public key using the recipient partial private key. The verification condition compares e(Prvreci,gpub) to e(H<NUM>(IDreci),H<NUM>(IDTC)).

If it is determined at step <NUM> that the verification condition is not satisfied, i.e. if it is determined that e(Prvreci,gpub) ≠ e(H<NUM>(IDreci)H<NUM>(IDTC)), then the processing may be end at step <NUM>.

If it is determined at step <NUM> that the verification condition is satisfied, i.e. if it is determined that e(Prvreci,gpub) = e(H<NUM>(IDreci),H<NUM>(IDTC)), then steps <NUM> to <NUM> may be performed to determine the first ciphertext set.

At step <NUM>, a random secret key denoted by σ may be generated.

At step <NUM>, a sender public key gsend = H<NUM>(IDsend) may be determined by applying the first cryptographic hush function H<NUM> to the sender identifier IDsend.

At step <NUM>, a first intermediate value r = H<NUM>(σ, pub<NUM>,pub<NUM>) may be determined by applying the third cryptographic hash function H<NUM> to the random secret key σ, the first public session key pub<NUM>, and to the second public session key pub<NUM>.

At step <NUM>, a first ciphertext V<NUM> may be determined by applying an exponentiation function of a basis equal to the trusted user public key gpub and an exponent equal to the first intermediate value r such that <MAT>. The exponentiation function may be replaced by a scalar multiplication such that V<NUM> = [r]gpub if the trusted center public key gpub corresponds to a point of an elliptic curve.

At step <NUM>, a second ciphertext U<NUM> may be determined by adding the random secret key σ to a value <MAT>, the value being determined by the application of the second cryptographic hash function H<NUM> to the output <MAT> of the application of the bilinear map e to a first input <MAT> and a second input H<NUM>(IDTC), the first input <MAT> being given by the application of an exponentiation function of a basis given by the sender public key gsend and an exponent given by the intermediate value r, the second input H<NUM>(IDTC) being determined by the application of the first cryptographic hash function H<NUM> to the trusted center identifier IDTC, the second ciphertext is according expressed as <MAT>. The addition operation may be performed over <MAT> in which case, the addition operation is an XOR operation.

At step <NUM>, a third ciphertext W<NUM> may be determined by applying a cipher algorithm Eσ(. ) to the first public session key pub<NUM> such that W<NUM> = Eσ(pub<NUM>), the cipher algorithm using the random secret key σ as encryption key.

At step <NUM>, a fourth ciphertext W<NUM> may be determined by applying the cipher algorithm Eσ(. ) to the second public session key pub<NUM> such that W<NUM> = Eσ(pub<NUM>).

At step <NUM>, a fifth ciphertext Y<NUM> may be determined by applying the second cryptographic hash function H<NUM> to the output of the application of the bilinear map exponent the first intermediate value (e(Prvreci,gsend))r, the output e(Prvreci,gsend) being obtained by applying the bilinear map e to the recipient partial private key Prvreci and the sender public key gsend. Accordingly, the fifth ciphertext is given by Y<NUM> = H<NUM>((e(Prvreci,gsend))r).

At step <NUM>, the first ciphertext set C<NUM> = {V<NUM>,U<NUM>,W<NUM>, W<NUM>, Y<NUM>} may be output.

<FIG> is a flowchart depicting a method for decrypting and authenticating the two public session keys at the sender <NUM> according to the Decrypt1 algorithm. This algorithm is executed by the sender <NUM>.

At step <NUM>, the inputs of the Decrypt1 algorithm may be received, including the sender identifier IDsend, the sender partial private key Prvsend, the recipient identifier IDreci, the first ciphertext set C<NUM> and the system parameters PK.

At step <NUM>, a recipient public key greci may be determined by applying the first cryptographic hash function H<NUM> to the recipient identifier IDreci such that greci = H<NUM> (IDreci),.

At step <NUM>, a secret key σ may be determined by applying a subtraction operation to the second ciphertext U<NUM> and the output H<NUM>(e(Prvsend,V<NUM>)) of the application of the second cryptographic hash function H<NUM> to the bilinear map e applied to the sender partial private key Prvsend and the first ciphertext V<NUM>, the secret key σ is accordingly expressed as σ = U<NUM> - H<NUM>(e(Prvsend,V<NUM>)). The subtraction operation may be performed over <MAT> in which case, the subtraction operation is an XOR operation.

At step <NUM>, a first public session key may be deciphered by applying a decipher Dσ(. ) to the third ciphertext W<NUM>, the decipher using the secret key σ as a decryption key, which provides a recovered first public session key given by pub<NUM> = Dσ(W<NUM>).

At step <NUM>, a second public session key by deciphered applying the decipher Dσ(. ) to the fourth ciphertext W<NUM>, which provides a recovered second public session key given by pub<NUM> = Dσ(W<NUM>).

At step <NUM>, a recovered intermediate value r = H<NUM>(σ, pub<NUM>, pub<NUM>) may be determined by applying the third cryptographic hash function H<NUM> to the secret key σ, the recovered first public session key pub<NUM>, and the recovered second public session key pub<NUM>.

At step <NUM>, the recipient identity may be verified by checking a verification condition comparing the fifth ciphertext Y<NUM> to the output H<NUM>((e(Prvsend,greci))r) of the application of the second cryptographic hash function H<NUM> to an input value (e(Prvsend,greci))r, the input value being given by the output e(Prvsend,greci) of the application of the bilinear map e to the sender partial private key Prvsend and the recipient public key greci to the power the recovered intermediate value r.

If it is determined at step <NUM> that the verification condition is not satisfied, i.e. that Y<NUM> ≠ H<NUM>((e(Prvsend,greci))r), then the processing may be interrupted at step <NUM>.

If it is determined at step <NUM> that the verification condition is satisfied, i.e. that Y<NUM> = H<NUM>((e(Prvsend,greci))r), then the recovered first public session key and the recovered second public session key may be output at step <NUM>.

<FIG> is a flowchart depicting a method for computing a second ciphertext at the sender <NUM> according to the Encrypt2 algorithm. This algorithm is executed by the sender <NUM>.

At step <NUM>, the inputs of the Encrypt2 algorithm may be received, including the recipient identifier IDreci, the sender partial private key Prvsend, the sender identifier IDsend, a given message M and the two public session keys pub<NUM>,pub<NUM> recovered at the sender <NUM>.

At step <NUM>, a trusted center identity verification condition may be checked by comparing e(Prvsend,gpub) to e(H<NUM>(IDsend),H<NUM>(IDTC)).

If it is determined at step <NUM> that the trusted center identity verification condition is not satisfied i.e. e(Prvsend,gpub) # e(H<NUM>(IDsend),H<NUM>(IDTC)), then the processing may be interrupted at step <NUM>.

If it is determined at step <NUM> that the trusted center identity verification condition is satisfied i.e. e(Prvsend,gpub) = e(H<NUM>(IDsend),H<NUM>(IDTC)), then a public session keys verification condition may be checked at step <NUM> comparing e(pub<NUM>,H<NUM>(IDsend)) to e(pub<NUM>,Prvsend).

If it is determined at step <NUM> that the public session keys verification condition is not satisfied, i.e. e(pub<NUM>,H<NUM>(IDsend)) ≠ e(pub<NUM>,Prvsend), then the processing may be interrupted at step <NUM>.

If it is determined at step <NUM> that the public session keys verification condition is satisfied, i.e. e(pub<NUM>,H<NUM>(IDsend)) = e(pub<NUM>,Prvsend), then steps <NUM> to <NUM> may be performed to determine the second ciphertext set C<NUM> = {V,U,C(M),Y} that comprises in addition to the encrypted message C(M), a first component V, a second component U, and a third component Y.

At step <NUM>, a recipient public key greci may be determined by applying the first cryptographic hash function H<NUM> to the recipient identifier IDreci such that greci = H<NUM>(IDreci),.

At step <NUM>, an auxiliary value r = H<NUM>(σ,M) may be determined by applying the third cryptographic hash function H<NUM> to the random secret key σ and to a given message M.

At step <NUM>, a first component V may be determined by applying an exponentiation function of a base equal to the trusted center public key gpub and an exponent equal to the auxiliary value r = H<NUM>(σ,M) such that the first component is given by <MAT>.

At step <NUM>, a second component U may be determined by adding the random secret key σ to the output <MAT> of the application of the second cryptographic hash function H<NUM> to the result <MAT> of the application of the bilinear map e to the first public session key to the power the auxiliary value and to the recipient public key greci, the second component is accordingly expressed as <MAT>. The addition operation performed to determine the second component may be performed over <MAT> in which case, the addition operation is an XOR operation.

At step <NUM>, an encrypted message C(M) may be determined by applying a cipher Eσ to the given message M using the random secret key σ such that C(M) = Eσ(M).

At step <NUM>, a third component Y = H<NUM>((e(Prvsend,greci))r) may be determined by applying the second cryptographic hash function H<NUM> to the result e(Prvsend,greci) of the application of the bilinear map e to the sender partial private key Prvsend and to the recipient public key greci, to the power the auxiliary value r.

At step <NUM>, the second ciphertext set C<NUM> = {V,U,C(M),Y} may be output.

<FIG> is a flowchart depicting a method for recovering an original message at the recipient <NUM> according to the Decrypt2 algorithm. This algorithm is executed by recipient <NUM>.

At step <NUM>, the inputs of the Decrypt2 algorithm may be received, including the private session key sk, the recipient partial private key Prvreci, the sender identifier IDsend, the second ciphertext set C<NUM> and the system parameters PK.

At step <NUM>, a sender public key gsend may be determined by applying the first cryptographic hash function H<NUM> to the sender identifier IDsend such that gsend = H<NUM>(IDsend).

At step <NUM>, a secret key σ may be determined by applying a subtraction operation to the second component U comprised in the second ciphertext set C<NUM> and to the output H<NUM>(e(V,sk)) of the application of the second cryptographic hash function H<NUM> to the result e(V,sk) of the application of the bilinear map e to the first component V comprised in the second ciphertext set and to the private session key sk, the recipient <NUM> having the private session key. The secret key is accordingly expressed as σ = U - H<NUM>(e(V, sk)). The subtraction operation performed to determine the secret key may be performed over <MAT> in which case, the subtraction operation is an XOR operation.

At step <NUM>, the original message M may be determined/recovered by decrypting the encrypted message C(M) using a decipher Dσ that uses the secret key σ as a decryption key.

At step <NUM>, an auxiliary value r = H<NUM>(σ,M) may be determined/computed by applying the third cryptographic hash function H<NUM> to the secret key σ and the original message M recovered at step <NUM>.

At step <NUM>, the identity of the sender <NUM> may be verified by checking if a sender identity verification condition is satisfied, the sender identity verification condition comparing the third component Y to H<NUM>((e(gsend,Prvreci))r).

If it is determined at step <NUM> that the sender identity verification condition is not satisfied, i.e. if Y ≠ H<NUM>((e(gsend,Prvreci))r), then the processing may be interrupted at step <NUM>.

If it is determined at step <NUM> that the sender identity verification condition is satisfied, i.e. if Y = H<NUM>((e(gsend,Prvreci))r), then the recovered original message M may be output at step <NUM>.

A proof of exchange is presented hereinafter.

For the Encrypt2 algorithm, the following holds:.

For the Decrypt2 algorithm, the following holds:.

In order to recover the symmetric secret key σ, it is obtained <MAT> <MAT>; and <MAT>.

So, the recipient <NUM> can retrieve the symmetric key σ using U + H<NUM>[e(V,sk)].

For the authentication of the sender <NUM>, it is obtained: <MAT>.

Using the sender partial private key, the trusted center <NUM> has the session public keys determined by the recipient <NUM> and sent to sender <NUM>. The problem of key escrow is resolved using this method. The trusted center <NUM> may not be able to retrieve the encrypted message M. The confidentiality of the message M is thus guaranteed.

There are no links between recipient identifier and the two public session keys pub<NUM> and pub<NUM>. Data encryption makes it more difficult to attack the sent session public keys. The consistency of both public session keys is verified by the sender <NUM>.

There is also provided a program stored in a computer-readable non-transitory medium for sending an encrypted message from a sender <NUM> to a recipient <NUM> in an identity-based cryptosystem <NUM> comprising a trusted center <NUM>, a sender private key being determined, at the trusted center <NUM> from a sender identifier associated with the sender <NUM>, and a recipient private key being determined, at the trusted center <NUM> from a recipient identifier associated with the recipient <NUM>. The program comprises instructions stored on the computer-readable storage medium, that, when executed by a processor, cause the processor to:.

The methods and devices described herein may be implemented by various means. For example, these techniques may be implemented in hardware, software, or a combination thereof. For a hardware implementation, the processing elements of the different devices operating in the system <NUM> can be implemented for example according to a hardware-only configuration (for example in one or more FPGA, ASIC, or VLSI integrated circuits with the corresponding memory) or according to a configuration using both VLSI and Digital Signal Processor (DSP).

<FIG> is a block diagram representing an exemplary hardware/software architecture of a device <NUM> operating in the cryptosystem <NUM> such as the sender <NUM>, the recipient <NUM>, or the trusted center <NUM>, according to some embodiments of the invention.

As illustrated, the architecture may include various computing, processing, storage, communication, sensing, and displaying units comprising:.

The architecture of the device <NUM> may further comprise one or more software and/or hardware units configured to provide additional features, functionalities and/or network connectivity.

Furthermore, the method described herein can be implemented by computer program instructions supplied to the processor of any type of computer to produce a machine with a processor that executes the instructions to implement the functions/acts specified herein. These computer program instructions may also be stored in a computer-readable medium that can direct a computer to function in a particular manner. To that end, the computer program instructions may be loaded onto a computer to cause the performance of a series of operational steps and thereby produce a computer implemented process such that the executed instructions provide processes for implementing the functions specified herein.

Claim 1:
A transmitter device (<NUM>) adapted to send an encrypted message to a receiver device (<NUM>) in an identity-based cryptosystem (<NUM>), the transmitter device (<NUM>) being associated with a transmitter identifier, wherein the transmitter device (<NUM>) is configured to receive a transmitter partial private key from a trusted center (<NUM>), said transmitter partial private key depending on the transmitter identifier associated with said transmitter device (<NUM>), the transmitter device (<NUM>) being configured to:
- send a request for two public session keys to the receiver device (<NUM>);
- receive from the receiver device (<NUM>) a first ciphertext set, said first ciphertext set being derived from an encryption and authentication of two public session keys;
- decrypt and authenticate the two public session keys from the first ciphertext set using a receiver identifier and the transmitter partial private key;
- determine a second ciphertext set from the transmitter partial private key, from the receiver identifier, and from the two public session keys, said second ciphertext comprising an encrypted message;
- send said second ciphertext set to the receiver device (<NUM>),
wherein the transmitter device (<NUM>) is configured to check whether a trusted center identity verification condition and/or a public session keys verification condition are verified, the trusted center identity verification condition being satisfied if the output of a bilinear map applied to the transmitter partial private key and to a trusted center public key is equal to the output of the bilinear map applied to:
- the result of a first cryptographic hash function applied to the transmitter identifier; and
- the result of the first cryptographic hash function applied to a trusted center identifier;
the public session keys comprising a first public session key and a second public session key, the public session keys verification condition being satisfied if the output of the bilinear map applied to the first public session key and to the result of the first cryptographic hash function applied to the transmitter identifier is equal to the output of the bilinear map applied to the second public session key and to the transmitter partial private key.