ID-based key exchange protocol with PFS The traditional authenticated DH protocol with PFS against active adversaries, ensures that the compromise of both party's long-term private keys after the session is completed will not help the adversary to compute session key, even adversary gets involved in the generation of messages.

An ID-based key-exchange has some differences with the traditional ones, such as it needs a KGC,

and public/private key generation is handled differently compared with the traditional ones.

Compared with the traditional authenticated DH protocol, what's the advantage of ID-based ones? 

And if I want to design a ID-based key-exchange protocol with a bilinear pairing especially under eCK model, are there some ways to realise PFS against active adversaries besides using digital signatures?

Where should I pay particular attention?
In an ordinary ID-based scheme, you won't get strong PFS.  The center always knows a secret that can be used to recover your private key and thus can violate PFS.

One approach is a hybrid scheme, such as the following.  You could do a (non-ID-based) Diffie-Hellman or ECDH key exchange, with messages signed and authenticated using an ID-based signature scheme.  You'd use the Diffie-Hellman/ECDH key exchange to derive an ephemeral session key for encrypting the rest of the channel.  That would get you PFS (against passive eavesdroppers), along with the advantages of ID-based cryptography.

Apparently, the following paper describes an even better scheme.


Okamoto-Tanaka Revisited: Fully Authenticated Diffie-Hellman with Minimal Overhead.   Rosario Gennaro and Hugo Krawczyk and Tal Rabin.  IACR ePrint 2010/068.


Their paper apparently provides PFS against passive attackers and PFS against active attackers (even if the center is corrupted, apparently).  Thanks to Alex for pointing this out.

The "advantage" of ID-based schemes is that you can use, e.g., someone's email address as their public key.  The disadvantage is that you must trust the center an awful lot, because the center knows or could compute everyone's private keys.  This is standard and you can find a lot written about ID-based key exchange that explains these tradeoffs in detail.