Cocks IBE scheme explained

Cocks IBE scheme is an identity based encryption system proposed by Clifford Cocks in 2001.^[1] The security of the scheme is based on the hardness of the quadratic residuosity problem.

Protocol

Setup

The PKG chooses:

1. a public RSA-modulus

style n = pq , where style p,q,p \equiv q \equiv 3 \bmod 4 are prime and kept secret,

1. the message and the cipher space

style l{M} = \left\{ -1 , 1 \right\}, l{C} = Z _{n} and

1. a secure public hash function

style f: \left\{ 0 , 1 \right\} ^{*} → Z _{n} .

Extract

When user

style ID wants to obtain his private key, he contacts the PKG through a secure channel. The PKG

1. derives

style a with style \left( (a)/(n) \right) = 1 by a deterministic process from style ID (e.g. multiple application of style f ),

1. computes

style r = a ^{(n+5-p-q)/8} \pmod n (which fulfils either style r ^{2} = a \pmod n or style r ^{2} = - a \pmod n , see below) and

1. transmits

style r to the user.

Encrypt

To encrypt a bit (coded as

style 1 /style -1 ) style m \in l{M} for style ID , the user

1. chooses random

style t _{1} with style m = \left( (t _{1})/(n) \right) ,

1. chooses random

style t _{2} with style m = \left( (t _{2})/(n) \right) , different from style t _{1} ,

1. computes

style c _{1} = t _{1} + at ^{-1} _{1} \pmod n and c _{2=} t _{2} - at ^{-1} _{2} \pmod n and

1. sends

style s = (c _{1,} c _{2)} to the user.

Decrypt

To decrypt a ciphertext

s = (c _{1,} c _{2)} for user ID , he

1. computes

\alpha = c _{1} + 2 r if r ^{2=a} or \alpha = c _{2} + 2 r otherwise, and

1. computes

m = \left( (\alpha)/(n) \right) .

Note that here we are assuming that the encrypting entity does not know whether

ID has the square root r of a or - a . In this case we have to send a ciphertext for both cases. As soon as this information is known to the encrypting entity, only one element needs to be sent.

Correctness

First note that since

style p \equiv q \equiv 3 \pmod 4 (i.e. \left( (-1)/(p) \right) = \left( (-1)/(q) \right) = -1 ) and style \left( (a)/(n) \right) ⇒ \left( (a)/(p) \right) = \left( (a)/(q) \right) , either style a or style - a is a quadratic residue modulo style n .

Therefore,

style r is a square root of style a or style - a :\begin{align} r ^{2} & = \left(a ^{(n+5-p-q)/8} \right) ^{2} \\ & = \left(a ^{(n+5-p-q} \right) ^{2} \\ & = \left(a ^{(n+5-p-q} \right) ^{2} \\ & = \left(a ^{(n+5-p-q} \right) ^{2} \\ & = \left(a ^{4/8} \right) ^{2} \\ & = \pm a \end{align}

Moreover, (for the case that

style a is a quadratic residue, same idea holds for style - a ):\begin{align} \left( (s +2 r)/(n) \right) & = \left( (t + at ^{-1} +2 r)/(n) \right) = \left( (t\left( 1+ at ^{-2} +2 rt ^{-1} \right))/(n) \right) \\ & = \left( (t\left( 1+ r ^{2t} ^{-2} +2 rt ^{-1} \right))/(n) \right) = \left( (t\left( 1+ rt ^{-1} \right) ^{2})/(n) \right) \\ & = \left( (t)/(n) \right) \left( (1+ rt ^{-1})/(n) \right) ^{2} = \left( (t)/(n) \right)(\pm 1 ) ^{2} = \left( (t)/(n) \right) \end{align}

Security

It can be shown that breaking the scheme is equivalent to solving the quadratic residuosity problem, which is suspected to be very hard. The common rules for choosing a RSA modulus hold: Use a secure

style n , make the choice of style t uniform and random and moreover include some authenticity checks for style t (otherwise, an adaptive chosen ciphertext attack can be mounted by altering packets that transmit a single bit and using the oracle to observe the effect on the decrypted bit).

Problems

A major disadvantage of this scheme is that it can encrypt messages only bit per bit - therefore, it is only suitable for small data packets like a session key. To illustrate, consider a 128 bit key that is transmitted using a 1024 bit modulus. Then, one has to send 2 × 128 × 1024 bit = 32 KByte (when it is not known whether

r is the square of a or −a), which is only acceptable for environments in which session keys change infrequently.

This scheme does not preserve key-privacy, i.e. a passive adversary can recover meaningful information about the identity of the recipient observing the ciphertext.

References

1. Clifford Cocks, An Identity Based Encryption Scheme Based on Quadratic Residues, Proceedings of the 8th IMA International Conference on Cryptography and Coding, 2001