What is Identity Based Encryption ?

If not redirected, please click here https://www.thesecuritybuddy.com/encryption/what-is-identity-based-encryption/

Encryption technology like DSA, RSA etc use public key cryptography. Every user gets his own public-private keypair using which anyone can start encrypted communication with the user. But, there is a major drawback in these technologies. They mostly depend on public key distribution infrastructure. Every user gets his keypair from a trusted Certificate Authority. And, anyone who wants to start an encrypted communication, has to obtain the public key certificate from the user and verify it with the Certificate Authority before the encrypted communication starts. This process is time consuming, error-prone and causes much inconvenience at times. Identity Based Encryption or IBE is an encryption technology which is developed to reduce these barriers up to a great extent and yet provide secure communications.

Identity Based Encryption or IBE is a type of public key encryption, in which the public key of a user is some unique information based on the identity of the user, such as an email address. Anyone who wants to send an encrypted message to the user, can encrypt it with the text value of the identity based public key, such as the text value of an email address, and send it across. The user can decrypt the message using the private key associated with the identity based public key.

How does Identity Based Encryption work ?

IBE works in the following way :

• A trusted third party called Private Key Generator or PKG first generates his own public-private keypair. It published its public key, called Master Public Key and keeps the private key, called Master Private Key or Master key secret to itself.
• A user who wants to generate a IBE keypair, first obtains the public key of the PKG. The user then combines his identity value, such as his email address, with the Master Public Key and generates the actual public key.
• The user then contacts the PKG with the public key. The PKG combines the user’s public key along with its own Master Private Key to generate the private key of the user.
• Anyone who wants to send an encrypted message to the user can encrypt it with the identity based public key, for example his email address. The user can decrypt it using his private key obtained from the PKG.

Can a user expire his Identity Based Encryption Keys?

Technically, one user can expire his IBE keys.

Suppose, a user named Bob wants to expire his IBE keys every year and he wants to use his email address bob@example.com for that purpose. To do that, Bob can append the current year with his email address, i.e. he can use ‘ bob@example.com | <current year> ‘ as the identity based public key, based upon which the PKG will generate his private key. The private key will be valid for that current year only. After the end of the year, Bob can again change the value of the current year in the identity based public key and obtain the corresponding new private key from the PKG.

Please note that, even if Bob changes his private key, a sender who wants to send encrypted message to Bob need not worry much. He will just change the value of the current year in the identity based public key, here ‘bob@example.com | <current year>’ and encrypt the message with that. Once a user gets his private key from the PKG, neither the user nor the sender need to communicate with the PKG further. And, this is one of the most significant advantages that IBE has.

What if a user’s Identity Based Encryption Keys are lost or stolen ?

Well, this problem also can be handled.

A user can append the current date instead of the current year with his identity, for example email address, to obtain his identity based public key and corresponding private key, as described above.

Now, suppose the user stores his private keys in his laptop and the laptop gets lost for three days. In that case, the private keys corresponding to those three days only will be compromised. The fourth day onwards, he can keep obtaining his new private keys from the PKG as usual and continue with normal operations.

Advantages of Identity Based Encryption

IBE has several advantages :

• If a user Alice wants to send an encrypted message to Bob, who has an email address bob@example.com, she does not need to obtain Bob’s public key certificate or verify it with any Certificate Authority. She can just encrypt the message using the text value of Bob’s email address bob@example.com and send it across. It is much more simple, convenient and less time consuming than any public key encryption technology based on Public Key Infrastructure.
• IBE eliminates the need of Public Key Infrastructure. Authenticity of the public key is implicit as an identity based value is used for that purpose.
• As IBE eliminates the need of certificates, it removes the hurdles of PKI, certificate lookup, key life cycle management, certificate revocation or cross-certification issues. It makes the security system much more dynamic, lightweight and scalable.
• An organization can maintain its own PKG very efficiently. It can issue a private key to every employee based on his corporate email address. And, when an employee leaves the organization, it can simply instruct the PKG not to generate any private keys for that user anymore.
• IBE can be efficiently used in some complex use case scenarios also. For example, suppose an employee has several assistants like purchasing, HR etc, who can read a number of emails if they fall within their responsibilities. In that case, a user can send the encrypted emails using the employee’s email address as well as a subject line indicating the appropriate assistant who would read the email. The PKG can generate a separate private key for each assistant based on the employee’s email address appended with the appropriate assistant and distribute it. As a result, an assistant can read the emails which fall within his responsibility, but not those of the others. And, it will be convenient for the sender also.

Drawbacks of Identity Based Encryption

IBE has a couple of drawbacks. The major ones are given below :

• If a PKG gets compromised, the messages protected by the Master Private Key will also be compromised.
• A PKG generates private keys of all the users using its own Master Private Key. So, technically it can sign or decrypt any message of its users without authorization. But as said earlier, an organization can have its own PKG and trust its administrators to counter this problem.

This was just an introductory article on Identity Based Encryption to give some basic information. Hope you liked it.




Read More

How are S/MIME and PGP different from each other in encrypting emails ?

What is Public Key Infrastructure or PKI ?

What is the difference between Public Key Encryption and Symmetric Key Encryption ?

What is PGP or Pretty Good Privacy ?

How to encrypt and decrypt files using GPG ?

What is Bitmessage and how can it be used to send encrypted messages ?

How to sign and encrypt emails using GPG ?

PGP vs OpenPGP vs GPG - How are they different from each other ?

How to make Digital Signatures of documents using GPG ?