Identity-based cryptography: Difference between revisions

Revision as of 07:00, 30 August 2009

Latest revision as of 12:42, 26 August 2025

(71 intermediate revisions by 46 users not shown)

Line 1:

'''Identity-based cryptography''' is a type of [[public-key cryptography]] in which the [[public key]] of a userpublicly isknown somestring uniquerepresenting informationan aboutindividual theor identityorganization ofis theused user (e.g.as a user's[[public email address)key]]. The Thispublic canstring usecould theinclude text-valuean ofemail the name oraddress, ___domain name, asor a key or the physical IP address it translates to.

[[File:TexasDMV_Message_example.jpg|thumb|Depiction of message from txdmv for unable to verify identity]]

The first implementation of identity-based signatures and an email-address based [[public-key infrastructure]] ('''PKI''') was developed by [[Adi Shamir]] in 1984,<ref>Adi{{cite Shamir,conference [http|url=https://wwwlink.isecaspringer.orgcom/modulescontent/mydownloadspdf/visit10.php?cid1007/3-540-39568-7_5.pdf |url-status=56&lid=33live |title=Identity-Based Cryptosystems and Signature Schemes]. ''|first=Adi |last=Shamir |author-link=Adi Shamir |year=1985 |conference=Lecture Notes in Computer Science |editor1-last=Blakley |editor1-first=George Robert |editor2-last=Chaum |editor2-first=David |editor-link1=George Blakley |editor-link2=David Chaum |volume=196 |edition=1 |book-title=Advances in Cryptology: Proceedings of CRYPTO '84, Lecture|publisher=Springer NotesBerlin inHeidelberg Computer|archive-url=https://web.archive.org/web/20180726050556/https://link.springer.com/content/pdf/10.1007/3-540-39568-7_5.pdf Science'',|archive-date=26 7:47July 2018 |pages=47–53 |isbn=978-3-53,540-39568-3 1984|doi=10.1007/3-540-39568-7_5 |doi-access=free |access-date=30 October 2024 |language=en }}</ref>, which allowed users to verify [[digital signatures]] using only public information such as the user's identifier. Under Shamir's scheme, a trusted third party would deliver the private key to the user after verification of the user's identity, with verification essentially the same as that required for issuing a [[public-key certificate|certificate]] in a typical PKI.

Shamir similarly proposed [[identity-based encryption]], which appeared particularly attractive since there was no need to acquire an identity's public key prior to encryption. However, he was unable to come up with a concrete solution, and identity-based encryption remained an open problem for many years. The first practical implementations were finally devised by Sakai in 2000,<ref>

{{cite journal

|last1=Sakai|first1=R

|last2=Ohgishi|first2=K

|last3=Kasahara|first3=M

|title=Cryptosystems based on pairings

|journal=SICS

|year=2000

|series=Symposium on cryptography and information security}}

</ref> and Boneh and Franklin in 2001.<ref>

{{cite conference

| last1 = Dan | first1 = Boneh

| last2 = Matt | first2 = Franklin

| title = Identity-based encryption from the Weil pairing

| series = Lecture Notes in Computer Science

| publisher = Springer

| book-title = Advances in Cryptology – CRYPTO 2001

| year=2001

| volume = 2139/2001 | pages = 213–229

| citeseerx = 10.1.1.66.1131

}}</ref> These solutions were based on [[pairing|bilinear pairings]]. Also in 2001, a solution was developed independently by [[Clifford Cocks]].<ref>

{{cite book

|last = Cocks

|first = Cliff

|title = Cryptography and Coding

|chapter = An Identity Based Encryption Scheme Based on Quadratic Residues

|series = Lecture Notes in Computer Science

|year = 2001

|volume = 2260/2001

|pages = 360–363

|url = http://www.cesg.gov.uk/site/ast/idpkc/media/ciren.pdf

|publisher = Springer

|doi = 10.1007/3-540-45325-3_32

|url-status = dead

|archive-url = https://web.archive.org/web/20070206084247/http://www.cesg.gov.uk/site/ast/idpkc/media/ciren.pdf

|archive-date = 2007-02-06

|isbn = 978-3-540-43026-1

|citeseerx = 10.1.1.116.5477

}}</ref><ref>{{cite web|archive-url=https://web.archive.org/web/20150627063023/http://www.bristol.ac.uk/pace/graduation/honorary-degrees/hondeg08/cocks.html|archive-date=2015-06-27|url=http://www.bristol.ac.uk/pace/graduation/honorary-degrees/hondeg08/cocks.html|publisher=University of Bristol|title=Dr Clifford Cocks CB, Honorary Doctor of Science}}</ref>

Closely related to various identity-based encryption schemes are identity based key agreement schemes. One of the first identity based key agreement algorithms was published in 1986, just two years after Shamir's identity based signature. The author was E. Okamoto.<ref>{{Cite journal|last=Okamoto|first=E.|date=1986|title=Proposal for identity-based key distribution systems|journal=Electronics Letters|volume=22|issue=24|pages=1283–1284|doi=10.1049/el:19860880|bibcode=1986ElL....22.1283O|issn=0013-5194}}</ref> Identity based key agreement schemes also allow for "escrow free" identity based cryptography. A notable example of such an escrow free identity based key agreement is the McCullagh-Barreto's "Authenticated Key Agreement without Escrow" found in section 4 of their 2004 paper, "A New Two-Party Identity-Based Authenticated Key Agreement".<ref>{{Cite conference|last1=McCullagh|first1=Noel|last2=Barreto|first2=Paulo S. L. M.|date=2004|title=A New Two-Party Identity-Based Authenticated Key Agreement|url=https://eprint.iacr.org/2004/122|conference=Lecture Notes in Computer Science|book-title=Topics in Cryptology – CT-RSA 2005|volume=3376}}</ref> A variant of this escrow free key exchange is standardized as the identity based key agreement in the Chinese identity based standard [[SM9 (cryptography standard)|SM9]].

==Usage==

Identity-based systems allow any party to generate a public key from a known identity value, such as an ASCII string. A trusted third party, called the [[Privateprivate Keykey Generator]]generator (PKG), generates the corresponding private keys. To operate, the PKG first publishes a master public key, and retains the corresponding '''master private key''' (referred to as ''master key''). Given the master public key, any party can compute a public key corresponding to the identity ''ID'' by combining the master public key with the identity value. To obtain a corresponding private key, the party authorized to use the identity ''ID'' contacts the PKG, which uses the master private key to generate the private key for the identity ''ID''.

==Limitation==

Identity-based systems have a characteristic problem in operation. Suppose Alice and Bob are users of such a system. Since the information needed to find Alice's public key is completely determined by Alice's ID and the master public key, it is not possible to revoke Alice's credentials and issue new credentials without either (a) changing Alice's ID (usually a phone number or an email address which will appear in a corporate directory); or (b) changing the master public key and re-issuing private keys to all users, including Bob.<ref name=green1>{{Cite book |doi=10.1109/SP.2015.26 |publication-date=20 July 2015 |date=17 May 2015 |publisher=ACM |last1=Green |first1=Matthew |last2=Miers |first2=Ian |title=2015 IEEE Symposium on Security and Privacy |chapter=Forward Secure Asynchronous Messaging from Puncturable Encryption |pages=305–320 |isbn=978-1-4673-6949-7 |s2cid=9171925 }}</ref>

This limitation may be overcome by including a time component (e.g. the current month) in the identity.{{r|green1}}

==See also==

* [[IDIdentity-based encryption]]

* [[Identity-based conditional proxy re-encryption]]

* [[SM9 (cryptography standard)|SM9 - Chinese National Identity Based Cryptography Standard]]

* [[Sakai–Kasahara scheme|Sakai–Kasahara Identity Based Encryption]]

* [[Boneh–Franklin scheme|Boneh–Franklin]]

==References==

{{Reflist}}

<references />

{{Cryptography navbox | public-key}}

[[Category:CryptographyPublic-key cryptography]]

[[Category:Identity-based cryptography]]