Boneh–Franklin scheme
The Boneh–Franklin scheme is an identity-based encryption system proposed by Dan Boneh and Matthew K. Franklin in 2001. This article refers to the protocol version called BasicIdent. It is an application of pairings (Weil pairing) over elliptic curves and finite fields.

Groups and parameters
As the scheme bases upon pairings, all computations are performed in two groups,  and :

For , let  be prime,  and consider the elliptic curve  over . Note that this curve is not singular as  only equals  for the case  which is excluded by the additional constraint.

Let  be a prime factor  of  (which is the order of ) and find a point  of order .  is the set of points generated by : 

 is the subgroup of order  of . We do not need to construct this group explicitly (this is done by the pairing) and thus don't have to find a generator.

Protocol description

Setup
The public key generator (PKG) chooses:
 the public groups  (with generator ) and  as stated above, with the size of  depending on security parameter ,
 the corresponding pairing ,
 a random private master-key ,
 a public key ,
 a public hash function ,
 a public hash function  for some fixed  and
 the message space and the cipher space

Extraction
To create the public key for , the PKG computes 
  and
 the private key  which is given to the user.

Encryption
Given , the ciphertext  is obtained as follows: 
 ,
 choose random ,
 compute  and
 set .

Note that  is the PKG's public key and thus independent of the recipient's ID.

Decryption 
Given , the plaintext can be retrieved using the private key:

Correctness
The primary step in both encryption and decryption is to employ the pairing and  to generate a mask (like a symmetric key) that is xor'ed with the plaintext. So in order to verify correctness of the protocol, one has to verify that an honest sender and recipient end up with the same values here.

The encrypting entity uses , while for decryption,  is applied. Due to the properties of pairings, it follows that:

Security
The security of the scheme depends on the hardness of the bilinear Diffie-Hellman problem (BDH) for the groups used. It has been proved that in a random-oracle model, the protocol is semantically secure under the BDH assumption.

Improvements
BasicIdent is not chosen ciphertext secure. However, there is a universal transformation method due to Fujisaki and Okamoto that allows for conversion to a scheme having this property called FullIdent.

References

External links
 Seminar 'Cryptography and Security in Banking'/'Alternative Cryptology', Ruhr University Bochum
 P(airing) B(ased) C(ryptography) library, designed by Ben Lynn et al.

Public-key encryption schemes
Pairing-based cryptography
Identity-based cryptography
Elliptic curve cryptography