Boneh–Franklin scheme
The Boneh–Franklin scheme is an identity-based encryption system proposed by Dan Boneh and Matthew K. Franklin in 2001. This article refers to the protocol version called BasicIdent. It is an application of pairings (Weil pairing) over elliptic curves and finite fields. Groups and parameters. As the scheme bases upon pairings, all computations are performed in two groups, formula_1 and formula_2: For formula_1, let formula_4 be prime, formula_5 and consider the elliptic curve formula_6 over formula_7. Note that this curve is not singular as formula_8 only equals formula_9 for the case formula_10 which is excluded by  the additional constraint. Let formula_11 be a prime factor of formula_12 (which is the order of formula_13) and find a point formula_14 of order formula_15. formula_1 is the set of points generated by formula_17: formula_18 formula_2 is the subgroup of order formula_15 of formula_21. We do not need to construct this group explicitly (this is done by the pairing) and thus don't have to find a generator. Protocol description. Setup. The public key generator (PKG) chooses: Extraction. To create the public key for formula_34, the PKG computes Encryption. Given formula_37, the ciphertext formula_38 is obtained as follows: Note that  formula_43 is the PKG's public key and thus independent of the recipient's ID. Decryption. Given formula_44, the plaintext can be retrieved using the private key: formula_45 Correctness. The primary step in both encryption and decryption is to employ the pairing and formula_46 to generate a mask (like a symmetric key) that is xor'ed with the plaintext. So in order to verify correctness of the protocol, one has to verify that an honest sender and recipient end up with the same values here. The encrypting entity uses formula_47, while for decryption, formula_48 is applied. Due to the properties of  pairings, it follows that: formula_49 Security. The security of the scheme depends on the hardness of the bilinear Diffie-Hellman problem (BDH) for the groups used. It has been proved that in a random-oracle model, the protocol is semantically secure under the BDH assumption. Improvements. BasicIdent is not chosen ciphertext secure. However, there is a universal transformation method due to Fujisaki and Okamoto that allows for conversion to a scheme having this property called FullIdent.