# Simplification of a pairing

The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification:

$$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\cdot e({C'}_{i}, {K'}_{uid,aid_k}^{-\text{GSK'}_{uid}})\cdot e(g, {D'}_i)^{-1} = e(g,g)^{au_{uid}\lambda_i}$$

I'm not able do this simplification step by step. Note: I removed some of the unnecessary indices.

$$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\cdot e({C'}_{i}, {K'}_{uid,aid_k}^{-\text{GSK'}_{uid}})\cdot e(g, {D'}_i)^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{\frac{r_i}{\beta}}, g^{u't\beta}\cdot H(x)^{v_i\beta(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't\beta}\cdot H(x)^{v_i\beta(u+\gamma)})^{\frac{1}{\beta}}\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

How can I arrive at $e(g,g)^{au\lambda_i}$ from this?

What am I missing so that I can do this simplification? I don't think I can come any further with the bilinearity $e(g^a,g^b)=e(g,g)^{ab}$.

Symbols:

• $e: \mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G_T}$
• $H: \{0,1\}^*\rightarrow\mathbb{G}$
• $a,u,u',\beta,\gamma,r_i,v_i,\lambda_i,t\in \mathbb{Z}_p$
• $x\in\{0,1\}^*$
• $i$ denotes a specific attribute
-

Surely bilinearity helps and and you have to be aware of the fact that $e(g^a,g^b)\cdot e(g^a,g^{-b})=e(g^a,g^b)\cdot e(g^a,g^b)^{-1}=1$.

You see that from your last equation $$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

you get

$$=e(g^{a\lambda_i},g^u)\cdot e(H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't})\cdot e(g^{r_i},H(x)^{v_iu})\cdot e(g^{r_i},H(x)^{v_i\gamma})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

and by rearanging the terms a bit and using bilinearity, the fact that you have a symmetric pairing (switch arguments) and the fact mentioned above you will notice that only the first term remains and that is your desired result.

-
You imply that $e(g^a\cdot h^b, g)=e(g^a, g)\cdot e(h^b, g)$. Is this a property of the bilinear map or does this come from somewhere else? I can see now that everything except the first term cancels out. – Artjom B. Jul 7 '14 at 18:54
@Artjom B. Thats simply application of bilinearity. Take as simple example $e(g^n,h)=e(g\cdot\ldots\cdot g,h)=e(g,h)\cdot\ldots\cdot e(g,h)=e(g,h^n)$ (where the dots always expand to $n$ elements\terms). – DrLecter Jul 7 '14 at 19:02