Security (CPA?,CCA?) in Authenticated identity-based encryption When I read authenticated identity-based encryption by Ben Lynn, encryption works to send data from user A to user B where:

$$a=e(d_{A},B)$$
$$s=H_{3}(Msg,K)$$
$$C=&lt;s,\gamma \oplus H_{2}(a,s),H_{4(\gamma)}(Msg)&gt;$$

Revealing [$H_{2}(a,s)$] can break the security if the correct ($a$) value is known by attacker.

The scheme may be CPA-secure if the private key extraction query restricts for sender's identity. However, if decryption oracle exists, will it be CCA-secure?

Attacker will modify the ciphertext as follows:

$$C^{*}=&lt;s,\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s),H_{4(\gamma)}(Msg)&gt;$$ 

where $t$ will be any pairing operation and submits $(C^{*},IDB)$ to decryption oracle. I think the oracle will return $\gamma \oplus H_{2}(t,s)$. Thus, attacker can easily reveal $\gamma$ by XORing with $ H_{2}(t,s)$.

Could you tell me if it is CCA-secure?



What is a suitable assumption for the problem of finding $e(d_{A},ID_{B})$ value knowing $ID_{A}$ and $ID_{B}$? Is it a bilinear Diffie-Hellman problem?
The eprint version has the following to say (adapted for your notation):


  Authenticated-decrypt: [...]
  Check that $s = H_3(\gamma, Msg)$. If not, reject the ciphertext, otherwise output then plaintext $Msg$.


In the attackers case, the decryption oracle would try to check if $s = H_3(\gamma', Msg)$ with $\gamma'=\gamma \oplus H_{2}(a,s) \oplus H_{2}(t,s) \oplus H_2(a, s) = \gamma \oplus H_{2}(t,s)$. This leads to a wrong hash and the oracle rejects the decryption before giving any useful information to the attacker.