Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given $$e(g, d) = c $$ where,

  • $e$ is bilinear pairing function chosen by the user/attacker,
  • the values of $g$ and $c$ are known
  • $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$

can we somehow compute the value of $d$

In a high level, I am asking if there exists a function $f$ that, in one way is the inverse of a $e$ can be used to compute $d$?

share|improve this question
What you describe is the so called pairing inversion problem. You may look here for some pointers to literature. – DrLecter Feb 6 '14 at 10:28
Thanks, the blog was quite interesting, and I am still going through it (for the second time). In the mean while, could I naively ask, if there is a "fault", or "a cheat", to compute the inverse of a pairing "quickly"? Say, I am looking from an attackers point of view, so an existential "cheat" would do fine as well. – Subhayan Feb 6 '14 at 21:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.