IBE ⇒ PKE

Fully-black-box reduction · standard model · folklore · security loss: tight: the reduction preserves the advantage exactly

Statement

Any IND-ID-CPA-secure IBE yields an IND-CPA-secure PKE: $\mathsf{KeyGen}$ runs $(\mathsf{pp},\mathsf{msk})\leftarrow \mathsf{Setup}(1^{\lambda })$, fixes an arbitrary identity $id$, and outputs $\mathsf{pk}=(\mathsf{pp},id)$ and $\mathsf{sk}=\mathsf{Extract}(\mathsf{msk},id)$; encryption is $\mathsf{Enc}(\mathsf{pp},id,\cdot )$ and decryption is $\mathsf{Dec}(\mathsf{sk},\cdot )$. The reduction fixes $id$ before $\mathsf{Setup}$ and makes no extraction queries, so IND-sID-CPA security suffices; the same construction maps IND-ID-CCA to IND-CCA security — folklore.

Sketch

The PKE is the IBE frozen at one identity; a PKE adversary is an IBE adversary against that identity that never queries the extraction oracle, with identical advantage.