A Separation Between Selective and Full-Identity Security Notions for Identity-Based Encryption

Identity-based encryption has attracted a lot of attention since the publication of the scheme by Boneh and Franklin. In this work we compare the two adversarial models previously considered in the literature, namely the full and selective-identity models. Remarkably, we show that the strongest security level with respect to selective-identity attacks (i.e. chosen-ciphertext security) fails to imply the weakest fullidentity security level (i.e. one-wayness). In addition, an analogous result for the related primitive of tag-based encryption is presented.