Why doesn't Cocks IBE use the hash function H from ID space to quadratic residue set $\mathbb{QR}_N$ in $\mathbb{Z}/N\mathbb{Z}$ to reduce the ciphertext expansion by half?
I think it is also IND-ID-CPA secure in random oracle because we can learn nothing from the ciphertext when the hash function H of some ID is chosen from $\mathbb{J}_N/\mathbb{QR}_N$.
