Identity-Based Encryption

Imagine you want to send an encrypted message to a colleague whose email address you already know. With classical public-key cryptography you have a problem: you first have to find their public key, verify it is really theirs through a certificate authority, and hope they have set one up. That bureaucratic chain stops many people from encrypting anything at all.

Identity-Based Encryption (IBE) cuts through that tangle. In IBE, any string — an email address, a phone number, even a date — acts directly as a public key. The sender encrypts to alice@example.com. When Alice later wants to read the message, she contacts a Private Key Generator (PKG), a trusted authority that uses a master secret to derive her personal decryption key.

The concept was sketched by Adi Shamir in 1984, but it took seventeen years until Dan Boneh and Matthew Franklin (2001) made it practical by exploiting the surprising algebraic structure of bilinear pairings on elliptic curves — the same building blocks that now power much of modern pairing-based cryptography.

The demo below simulates the four core IBE operations in a simplified, illustrative model (real pairings use 256-bit fields; here we use tiny numbers so you can follow along).

<!-- {{c_ibe_demo_title}} -->
<div class="panel">
  <h3>{{h_pkg_setup}}</h3>
  <div class="field-row">
    <label>{{lbl_master_secret}} <em>(s)</em></label>
    <input id="masterSecret" type="number" min="2" max="20" value="7" />
    <button id="btnSetup" type="button">{{btn_setup}}</button>
  </div>
  <div id="setupOut" class="output hidden"></div>
</div>
<div class="panel">
  <h3>{{h_extract}}</h3>
  <div class="field-row">
    <label>{{lbl_identity}}</label>
    <input id="identity" type="text" value="alice@example.com" placeholder="{{ph_identity}}" />
    <button id="btnExtract" type="button">{{btn_extract}}</button>
  </div>
  <div id="extractOut" class="output hidden"></div>
</div>
<div class="panel">
  <h3>{{h_encrypt}}</h3>
  <div class="field-row">
    <label>{{lbl_message}}</label>
    <input id="message" type="number" min="1" max="22" value="10" placeholder="{{ph_message}}" />
    <button id="btnEncrypt" type="button">{{btn_encrypt}}</button>
  </div>
  <div id="encryptOut" class="output hidden"></div>
</div>
<div class="panel">
  <h3>{{h_decrypt}}</h3>
  <button id="btnDecrypt" type="button">{{btn_decrypt}}</button>
  <div id="decryptOut" class="output hidden"></div>
</div>

/* {{c_css_base}} */
* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; font-size: .9rem; }
h3 { margin: 0 0 .45rem; font-size: .93rem; color: #1d3557; }
.panel { background: #f4f7fa; border: 1px solid #cdd9e3; border-radius: 10px;
         padding: .7rem .9rem; margin-bottom: .6rem; }
.field-row { display: flex; flex-wrap: wrap; align-items: center; gap: .4rem; }
label { font-weight: 600; min-width: 7.5rem; }
input[type=text], input[type=number] { flex: 1; min-width: 0; padding: .32rem .5rem;
  border: 1px solid #adb1b8; border-radius: 6px; font-size: .88rem; }
button { font: 600 .84rem system-ui, sans-serif; padding: .35rem .78rem;
         border: 1px solid #1d3557; background: #1d3557; color: #fff;
         border-radius: 7px; cursor: pointer; white-space: nowrap; }
.output { margin-top: .5rem; background: #fff; border: 1px solid #cdd9e3;
          border-radius: 7px; padding: .45rem .7rem; font-size: .82rem;
          line-height: 1.65; font-family: ui-monospace, monospace; }
.output.ok { border-left: 3px solid #0a7d33; }
.output.bad { border-left: 3px solid #c92f3c; color: #c92f3c; }
.hidden { display: none; }
.kv { display: grid; grid-template-columns: auto 1fr; gap: .12rem .55rem; }
.kv b { color: #1d3557; white-space: nowrap; }

// Code not found

Notice what makes IBE different: the sender only needs a public string (the recipient's identity) and the public parameters broadcast by the PKG. The PKG's master secret is never seen by either party. Decryption only works for the legitimate key holder — anyone else who intercepts the ciphertext cannot recover the message without the PKG-issued private key.

IBE security does not rest on NP-completeness — it rests on a hardness assumption about a specific algebraic structure.

• Bilinear pairing. A pairing $e: G_1 \times G_1 \to G_2$ is a map between two groups that satisfies $e(aP, bQ) = e(P, Q)^{ab}$ for any points $P, Q$ and scalars $a, b$. This "bilinearity" is what lets the PKG bind an identity string to a group element that the sender can use.
• The Bilinear Diffie-Hellman (BDH) problem. Given $P$, $aP$, $bP$, $cP$ on an elliptic curve, compute $e(P, P)^{abc}$. No efficient algorithm is known. Boneh and Franklin proved in the random oracle model that any attacker who breaks their IBE scheme can be converted into a solver for BDH — so if BDH is hard, IBE is secure.
• Why not just use RSA or ECDH? Classical schemes need a public-key infrastructure (PKI) to bind identity to key. IBE folds identity into the key derivation itself. The price is a trusted PKG; the gain is zero infrastructure for senders.
• Known after the fact. A subtlety: the PKG can derive anyone's private key, so IBE has key escrow built in. Variants like Hierarchical IBE (HIBE) and Attribute-Based Encryption (ABE) extend or mitigate this.

The Weil and Tate pairings on supersingular elliptic curves are the concrete instantiation Boneh and Franklin used. Compare this with discrete logarithm, whose hardness underpins classical Diffie-Hellman — IBE simply lives one algebraic layer higher.

IBE solves a real bootstrapping problem and has spun off a rich family of constructions:

• Encrypted email without PKI: a company can run its own PKG and let any employee encrypt to name@company.com without pre-distributing certificates.
• Time-based forward security: encrypt today to alice@example.com||2026-07-01; Alice can only decrypt on that date, when the PKG releases the key for that identity string.
• Attribute-Based Encryption (ABE): a generalization where the "identity" is a set of attributes (role=doctor AND clearance=level3) and decryption only works if the recipient's credentials satisfy the policy. ABE powers fine-grained access control in cloud storage.
• Certificate-less cryptography: modern standards like Lattices / SVP-based IBE schemes aim to keep the zero-infrastructure benefit while resisting quantum attacks.
• Broadcast encryption: IBE ideas underlie systems that encrypt once to a large group defined by a predicate rather than a list.

The Boneh-Franklin paper is one of the most cited in applied cryptography — not because IBE replaced PKI everywhere, but because pairings unlocked a completely new design space for cryptographic protocols.

Identity-Based Encryption achieved something elegant: it turned the question "how do I find your key?" into "I already have it — it's your name." Boneh and Franklin showed in 2001 that bilinear pairings on elliptic curves make this dream mathematically rigorous, with security provably as hard as the Bilinear Diffie-Hellman problem.

The catch — a trusted PKG that can derive any private key — keeps IBE out of fully decentralized systems. But the ideas it unlocked, from Attribute-Based Encryption to pairing-based signatures, have shaped a generation of cryptographic protocols. Next time you see a zero-knowledge proof or a threshold signature scheme, there is a good chance a bilinear pairing is quietly doing the heavy lifting.

For a related hardness story, see discrete logarithm — the classical problem IBE's assumptions descend from.