What are the benefits of being able to choose (most of) the public key in a PKC? We're developing a public key cryptosystem whose ciphertexts are actually much more long than the plaintexts (which, according to this question, is more a benefit than an issue).

However, we have a particular property. Most part of the public key can be chosen by the user. More precisely (in a high level explanation), the public key is $n+n^2$ bytes long where $n^2$ of them are chosen at random and the other $n$ bytes are certain function of these values and the secret key.

I was thinking that maybe we could choose these values not at random, but with certain structure: as we wish. For instance, it could be user's mail address or some function of it (expansion function, since $n^2$ is not small). I think this is close to ID-based encryption, but I don't understand this concept so deeply to state a relation. Moreover, not all the public key can be chosen so I'm not sure whether or not this is useful at all, or meet any requirements.


  Is this property useful in any sense? can we get something good from this?


Having so long public keys is a storage problem, that we would like to balance with a good property from this "free choice" fact.
That property lets a trusted n2-byte random string be
enough to make the rest of public keys fit into n bytes.
In particular, forward secrecy can be more efficient if the sender can store such a string, since the string can have been generated by the same party as generates the rest of the public keys.



Also, if for random private keys and independent n2-byte random strings r0 and r1,

the distributions
$\langle$ rest_of_public_key_(r0,priv_key) , r0 $\rangle$ ​ ​ ​ , ​ ​ ​ $\langle$ rest_of_public_key_(r1,priv_key) , r0 $\rangle$
are indistinguishable

and

"encryptions" with ​ ​ $\langle$ rest_of_public_key_(r1,priv_key) , r0 $\rangle$

provide confidentiality even against the private key holder

, ​ ​ then you get a one-message-in-each-direction

oblivious transfer protocol against semi-honest receivers.