Removing Escrow from Identity-Based Encryption [chapter]

Sherman S. M. Chow
2009 Lecture Notes in Computer Science  
Key escrow is inherent in identity-based encryption (IBE). A curious key generation center (KGC) can simply generate the user's private key to decrypt a ciphertext. However, can a KGC still decrypt if it does not know the intended recipient of the ciphertext? We answer by formalizing KGC anonymous ciphertext indistinguishability (ACI − KGC). We find that all existing pairing-based IBE schemes without random oracles, whether receipt-anonymous or not, do not achieve KGC onewayness, a weaker
more » ... of ACI − KGC. In view of this, we first show how to equip an IBE scheme by Gentry with ACI − KGC. Second, we propose a new system architecture with an anonymous private key generation protocol such that the KGC can issue a private key to an authenticated user without knowing the list of users identities. This also better matches the practice that authentication should be done with the local registration authorities instead of the KGC. Our proposal can be viewed as mitigating the key escrow problem in a different dimension than distributed KGCs approach. The author would like to thank Yevgeniy Dodis for the inspiration of this research and many fruitful discussions, Kenneth Paterson for his invaluable assistance and suggestions, and Melissa Chase for her helpful comments.
doi:10.1007/978-3-642-00468-1_15 fatcat:y3w6wwgdmrfbvhncy3rd3ecy7a