Publications

In a batched identity-based encryption (IBE) scheme, ciphertexts are associated with a batch label \( \mathsf{tag}^\ast \) and an identity \( \mathsf{id}^\ast \) while secret keys are associated with a batch label \( \mathsf{tag} \) and a set of identities \( S \). Decryption is possible whenever \( \mathsf{tag} = \mathsf{tag}^\ast \) and \( \mathsf{id}^\ast \in S \). The primary efficiency property in a batched IBE scheme is that the size of the decryption key for a set \( S \) should be independent of the size of \( S \). Batched IBE schemes provide an elegant cryptographic mechanism to support encrypted memory pools in blockchain applications.

In this work, we introduce a new algebraic framework for building pairing-based batched IBE. Our framework gives the following:

• First, we obtain a selectively-secure batched IBE scheme under a \( q \)-type assumption in the plain model. Both the ciphertext and the secret key consist of a constant number of group elements. This is the first pairing-based batched IBE scheme in the plain model. Previous pairing-based schemes relied on the generic group model and the random oracle model.

• Next, we show how to extend our base scheme to a threshold batched IBE scheme with silent setup. In this setting, users independently choose their own public and private keys, and there is a non-interactive procedure to derive the master public key (for a threshold batched IBE scheme) for a group of users from their individual public keys. We obtain a statically-secure threshold batched IBE scheme with silent setup from a \( q \)-type assumption in the plain model. As before, ciphertexts and secret keys in this scheme contain a constant number of group elements. Previous pairing-based constructions of threshold batched IBE with silent setup relied on the generic group model, could only support a polynomial number of identities (where the size of the public parameters scaled linearly with this bound), and ciphertexts contained \( O(\lambda / \log \lambda) \) group elements, where \( \lambda \) is the security parameter.

• Finally, we show that if we work in the generic group model, then we obtain a (threshold) batched IBE scheme with shorter ciphertexts (by 1 group element) than all previous pairing-based constructions (and without impacting the size of the secret key).

Our constructions rely on classic algebraic techniques underlying pairing-based IBE and do not rely on the signature-based witness encryption viewpoint taken in previous works.