Certificateless Public Key Encryption Without Pairing

Abstract

Abstract. "Certificateless Public Key Cryptography" has very appealing features, namely it does not require any public key certification (cf. traditional Public Key Cryptography) nor having key escrow problem (cf. Identity-Based Cryptography). Unfortunately, construction of Certificateless Public Key Encryption (CLPKE) schemes has so far depended on the use of Identity-Based Encryption, which results in the bilinear pairing-based schemes that need costly operations. In this paper, we consider a relaxation of the original model of CLPKE and propose a new CLPKE scheme that does not depend on the bilinear pairings. We prove that in the random oracle model, our scheme meets the strong security requirements of the new model of CLPKE such as security against public key replacement attack and chosen ciphertext attack, assuming that the standard Computational Diffie-Hellman problem is intractable.

On Constructing Certificateless Cryptosystems from Identity Based Encryption

“…The recent pairing-free scheme of Baek et al [4] fits a slightly different model where users have to obtain their partial private key and a partial public key before generating their full public key. This approach is closer to the "self-certified" paradigm [23] which is another approach suggested by Girault in 1991 to use public key cryptography without traditional digital certificates and without involving an escrow authority.…”

“…The security models considered in [4,16,29] are weaker in that they disallow Type I attackers to ever extract the partial private key of the target entity. In contrast, the above model allows them to do so as long as they do not additionally replace the associated public key.…”

“…The latter strategy allows us to handle decryption queries even when the relevant public key was replaced. It is a generic knowledge extractor (in the random oracle model) while previous works [2,3,4] that considered the treatment of this kind of decryption requests only used knowledge extractors that were specific to their schemes. Proof.…”

“…It has a comparable efficiency to the pairing-free scheme of [4]. The receiver has to compute a pairing, an exponentiation in G 2 beside a multi-exponentiation in G 1 .…”

“…Both works [9,16] considered a model of security which is noticeably weaker (albeit realistic in practice) than the original one [2]. A very recent paper by Baek et al [4] also showed how to devise a certificateless encryption scheme without pairings. The latter construction enjoys a better efficiency than pairing-based proposals [2,3,16] but is supported by a weaker security model and prevents users from generating their public key independently from the system's authority.…”