Identity-Based Encryption.

Public-key encryption where an arbitrary identifier (email, phone) serves as the public key, with private keys issued by a trusted Private Key Generator (Boneh/Franklin 2001). It belongs to the Cryptography category of cybersecurity.

Public-key encryption where an arbitrary identifier (email, phone) serves as the public key, with private keys issued by a trusted Private Key Generator (Boneh/Franklin 2001).

Identity-Based Encryption (IBE) lets the sender encrypt directly to a recipient's identity string - for example alice@example.com - without first fetching a certificate. A trusted authority called the Private Key Generator (PKG) holds a master secret, publishes master public parameters, and on demand derives the recipient's private key from their identity. The first practical IBE was Boneh-Franklin (2001), based on bilinear pairings; the Sakai-Kasahara and Cocks IBE schemes followed. IBE eliminates X.509 certificate management at the cost of inherent key escrow, since the PKG can decrypt all messages. It is standardised in IETF RFC 5091 and used in MIKEY-SAKKE for UK/EU secure voice, S/MIME alternatives, IoT key bootstrapping, and as a stepping stone toward attribute-based and functional encryption.

Defences for Identity-Based Encryption typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: IBE, Boneh-Franklin IBE, Identity-based cryptography.