Selecting secret value in certificateless identity-based encryption In certificateless identity-based cryptography, selecting secret value $$x_i \in Z_p$$ and declaring public key of individual users such as $$Pub_i=g^{x_i}$$
$g$ is public parameter. 
I think there will be some kind of collision in selecting secret value.
In security proof, they make assumption that secret value cannot be allowed to attackers. Is it enough?
I think there will be some kind of collision in selecting secret value.


What sort of collision could there be (that has a nontrivial probability of actually happening)?

If $p$ is the order of $g$, then $Pub_i = Pub_j$ only if $x_i = x_j$.  And, if $p$ is large (e.g. at least 256 bits), and we assume that $x_i, x_j$ are selected randomly and independently (that is, no one participant is allowed to peak at any of the other's secret, and they all have good entropy), then the probability of $x_i = x_j$ happening is $&lt; 2^{-256}$, that is, mindboggling unlikely.

In fact, if we have, say 7 billion participants, and each one selects an $x_n$ randomly, the probability of there exists two different participants selecting the same value is $&lt; 2^{-191}$, still mindboggling unlikely.

This does assume that the entropy of each participant is good; something that tends to be ignored in security proofs, but cannot be ignored when implementing the system.


  In security proof, they make assumption that secret value cannot be allowed to attackers. Is it enough?


They also assume (and they ought to make it explicit) that the discrete log problem is hard; that is, given the value $g^{x_i}$, it's hard to recover $x_i$.  If the group was small enough that someone would have a nontrivial probability of obtaining $x_i$, by guessing it (and computing $g^{x}$ to verify), well, that'd mean that the discrete log problem would be tractable.