I agree that we should add one pairing to the efficiency of GS-HIBE
that
I stated. However, GS-HIBE is as efficient as BBG/BB-HIBE, and is not
worse when t is small.
No, it's not; it's less efficient, even for t=1.
My claim is that GS-HIBE is more efficient under some environments. For
example, BBG-HIBE scheme requires more number of pairings than GS-HIBE
in decryption when t is small. If the smaller number of pairings in
decryption is the dominant factor of the efficiency of a system, then
GS-HIBE is more efficient. All we can say is that BB/BBG-HIBE can be
more efficient than GS-HIBE under some environments, as well as GS-HIBE
can be under others.
I think there is no significant flaw in the GS-HIBE scheme that makes us
exclude it from this working draft.
On May 27, 2009, at 2:11 AM, kobayashi.tetsutaro wrote:
Please notice that I am just proposing an HIBE schme, and not making
objection to proposing BBG/BB-HIBE.
Well, I am, to GS; unless there's a legacy need to standardize GS --
that is, if someone is actually using it -- then I believe it should
not be offered as an option.
I agree that we should add one pairing to the efficiency of GS-HIBE
that
I stated. However, GS-HIBE is as efficient as BBG/BB-HIBE, and is not
worse when t is small.
No, it's not; it's less efficient, even for t=1.
-hs.