(Warning: mathematics ahead. But there is a summary at the end.)
IBE, as implemented by Voltage, uses a pairing. Known efficient pairings work over specially crafted elliptic curves (the two main pairings are Weil pairing and Tate pairing, and there exist some variants of the latter which offer performance boosts in some situations). These pairings were discovered by mathematicians in the 1950s; application of pairings to cryptography was first hinted at by Miller in the 1980s.
Initially, pairings were thought of ways to attack elliptic curve systems -- by reducing discrete logarithm on elliptic curve to discrete logarithm into a more "easy" field. The critical parameter is the "embedding degree", which I will note k. For a normal n-bit elliptic curve, discrete logarithm is hard up to 2n/2 operations, hence a 256-bit curve is enough for the standard "128-bit security". For a given curve, a pairing can be defined, which can be used to transform a discrete logarithm problem on the curve into a discrete logarithm problem in a multiplicative subgroup of a field of kn bits. The k parameter depends on the curve which is used. E.g., if you have a 256-bit curve with a very low k=2 embedding degree, then discrete logarithm on that curve is no harder than discrete logarithm in a multiplicative subgroup of a 512-bit field, which is much easier (a 530-bit discrete logarithm was performed in 2007).
Fortunately, a "normal" curve will have a very high embedding degree; a typical 256-bit elliptic curve will sport an embedded degree around 2255, i.e. much greater than 2 or 3. Selection of an elliptic curve according to the relevant standard (ANSI X9.62-2005) involves verifying that k is no lower than 100, which is invariably true with an overwhelming probability for a randomly selected curve anyway. This is called the "MOV condition".
An efficient pairing requires that kn is not too big, because the paring result is a kn-bit value and we want to do some relatively heavy computations with such values (modular exponentiations...). Hence, a pairing for IBE (not for attacks) needs a "weakened" curve with a very low embedding degree. The scheme described in the Boneh-Franklin article (2003) uses a 512-bit elliptic curve with the special property of being "supersingular", which implies (here) an embedding degree k=2 (thus the resulting security is that of discrete logarithm in a 1024-bit field, roughly similar to 1024-bit RSA).
Summary: the mathematical details above are meant to show where IBE stands:
- The first practical implementation is described in an article from 2003.
- That implementation works on elliptic curves with a special structure which was initially thought of as a weakness.
- Use of elliptic curves for cryptography dates from the 1980s. Elliptic curves are deemed secure because nobody could find any internal structure which could be exploited to speed up discrete logarithm on elliptic curve -- except pairings, which are fortunately inapplicable to "normal" curves. But for IBE, we need a "weak" curve.
So IBE security, in practice, stands on a careful dosage of weakness injected in an elliptic curve, and the details were defined less than ten years ago. This is not an awful lot of time. In comparison, research on integer factorization can boast a whooping 2500 years of history (at least) so when we claim that factorization must be a hard problem, we have some facts to back that assertion up. Accumulated research time is the main, and mostly the only, metric by which cryptographic risk can be estimated.
Hence, IBE is a bit young to my taste for unchecked general deployment. Yet, you can do much worse than following Dan Boneh's steps and chances are that if (when) you will get hacked, it will not be due to any mathematical issue in pairings. Also, pairings are fun (for a mathematician, that is).
A good reading on pairings is Ben Lynn's PhD thesis (his advisor was Boneh, by the way).