Authenticated ID-based cryptosystem with no key escrow

A method of determining a shared secret between a first entity and a second entity in a cryptosystem, wherein a first public key PA in a first cyclic group Γ is associated with the first entity, a second public key PB in the first group Γ is associated with the second entity, a master secret s in the ring Z/λZ is associated with a private key generator, a first private key SA=sPA is associated with the first entity, a second private key SB=sPB is associated with the second entity, and both the first entity and the second entity know a non-interactive shared secret SAB=ê(PA, SB)=ê(SA, PB), wherein ê is a bilinear function and SAB is an element in the second cyclic group H, the method comprising:

• selecting a first random integer a;
• calculating a first intermediate shared secret component ga, wherein g is a predetermined element of a second cyclic group H;
• communicating the first intermediate shared secret component ga to the second entity;
• selecting a second random integer b;
• calculating a second intermediate shared secret component gb;
• communicating the second intermediate shared secret component gb to the first entity;
• calculating an interactive shared secret gab=(ga)b;
• =(gb)a;
• confirming that the first entity knows the non-interactive shared secret SAB;
• confirming that the second entity knows the non-interactive shared secret SAB;
• and
• determining the shared secret using at least the interactive shared secret gab.

A method of determining a shared secret between a first entity and a second entity in a cryptosystem, wherein a first public key PA in a first cyclic group Γ is associated with the first entity, a second public key PB in the first group Γ is associated with the second entity, a master secret s in the ring Z/λZ is associated with a private key generator, a first private key SA=sPA is associated with the first entity, a second private key SB=sPB is associated with the second entity, and both the first entity and the second entity know a non-interactive shared secret SAB=ê(PA, SB)=ê(SA, PB), wherein ê is a bilinear function and SAB is an element in the second cyclic group H, the method comprising:

• selecting a first random integer a;
• calculating a first intermediate shared secret component aP, wherein P is a predetermined element of a second cyclic group H;
• communicating the first intermediate shared secret component aP to the second entity;
• selecting a second random integer b;
• calculating a second intermediate shared secret component bP;
• communicating the second intermediate shared secret component bP to the first entity;
• calculating an interactive shared secret abP=a(bP)=b(aP);
• and
• confirming that the first entity knows the non-interactive shared secret SAB;
• confirming that the second entity knows the non-interactive shared secret SAB;
• and
• determining the shared secret using at least the interactive shared secret abP.