Generic Constructions of Revocable Identity-Based Encryption

Abstract

Revocable identity-based encryption (RIBE) is an extension of IBE which can support a key revocation mechanism, and it is important when deploying an IBE system in practice. Boneh and Franklin (Crypto’01) presented the first generic construction of RIBE, however, their scheme is not scalable where the size of key updates is linear in the number of users in the system. Then, Boldyreva, Goyal and Kumar (CCS’08) presented the first scalable RIBE which significantly reduces the size of key update to logarithmic in the number of users. In this paper, we first present a generic construction of scalable RIBE from any IBE in a black-box way which solves the open problem presented by Seo and Emura (PKC’13). Our construction has some merits both in theory and practice. In theory, we can obtain the first RIBE scheme from quadratic residues modulo composite and the first adaptive-ID secure RIBE scheme from lattices if we instantiate the underlying IBE with IBE schemes from quadratic residues modulo composite and adaptive-ID secure IBE schemes from lattices, respectively. In practice, public parameters size and secret keys size of our construction can be same as those of the underlying (H)IBE scheme. Our construction is naturally server-aided where the overheads of decryption computation for receivers is the same as that of underlying IBE schemes. Inspired by recent work of Katsumata et al. (PKC’19), we present a generic construction of RIBE with decryption key exposure resistance by using hierarchical IBE (HIBE) and IBE schemes. Finally, we reduce the ciphertext size to constant by using two HIBE schemes.