Threshold Batched Identity-Based Encryption from Pairings in the Plain Model

In a batched identity-based encryption (IBE) scheme, ciphertexts are associated with a batch label tg * and an identity id * while secret keys are associated with a batch label tg and a set of identities 𝑆. Decryption is possible whenever tg = tg * and id * ∈ 𝑆. The primary efficiency property in a batched IBE scheme is that the size of the decryption key for a set 𝑆 should be independent of the size of 𝑆. Batched IBE schemes provide an elegant cryptographic mechanism to support encrypted memory pools in blockchain applications.

In this work, we introduce a new algebraic framework for building pairing-based batched IBE. Our framework gives the following:

• First, we obtain a selectively-secure batched IBE scheme under a 𝑞-type assumption in the plain model. Both the ciphertext and the secret key consist of a constant number of group elements. This is the first pairing-based batched IBE scheme in the plain model. Previous pairing-based schemes relied on the generic group model and the random oracle model.

• Next, we show how to extend our base scheme to a threshold batched IBE scheme with silent setup. In this setting, users independently choose their own public and private keys, and there is a non-interactive procedure to derive the master public key (for a threshold batched IBE scheme) for a group of users from their individual public keys. We obtain a statically-secure threshold batched IBE scheme with silent setup from a 𝑞-type assumption in the plain model. As before, ciphertexts and secret keys in this scheme contain a constant number of group elements. Previous pairing-based constructions of threshold batched IBE with silent setup relied on the generic group model, could only support a polynomial number of identities (where the size of the public parameters scaled linearly with this bound), and ciphertexts contained 𝑂 (𝜆/log 𝜆) group elements, where 𝜆 is the security parameter.

• Finally, we show that if we work in the generic group model, then we obtain a (threshold) batched IBE scheme with shorter ciphertexts (by 1 group element) than all previous pairing-based constructions (and without impacting the size of the secret key).

Our constructions rely on classic algebraic techniques underlying pairing-based IBE and do not rely on the signaturebased witness encryption viewpoint taken in previous works.