Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification:

$$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\cdot e({C'}_{i}, {K'}_{uid,aid_k}^{-\text{GSK'}_{uid}})\cdot e(g, {D'}_i)^{-1} = e(g,g)^{au_{uid}\lambda_i}$$

I'm not able do this simplification step by step. Note: I removed some of the unnecessary indices.

$$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\cdot e({C'}_{i}, {K'}_{uid,aid_k}^{-\text{GSK'}_{uid}})\cdot e(g, {D'}_i)^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{\frac{r_i}{\beta}}, g^{u't\beta}\cdot H(x)^{v_i\beta(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't\beta}\cdot H(x)^{v_i\beta(u+\gamma)})^{\frac{1}{\beta}}\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

$$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

How can I arrive at $e(g,g)^{au\lambda_i}$ from this?

What am I missing so that I can do this simplification? I don't think I can come any further with the bilinearity $e(g^a,g^b)=e(g,g)^{ab}$.

Symbols:

  • $e: \mathbb{G}\times\mathbb{G}\rightarrow\mathbb{G_T}$
  • $H: \{0,1\}^*\rightarrow\mathbb{G}$
  • $a,u,u',\beta,\gamma,r_i,v_i,\lambda_i,t\in \mathbb{Z}_p$
  • $x\in\{0,1\}^*$
  • $i$ denotes a specific attribute
share|improve this question

1 Answer 1

up vote 2 down vote accepted

Surely bilinearity helps and and you have to be aware of the fact that $e(g^a,g^b)\cdot e(g^a,g^{-b})=e(g^a,g^b)\cdot e(g^a,g^b)^{-1}=1$.

You see that from your last equation $$=e(g^{a\lambda_i}\cdot H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't}\cdot H(x)^{v_i(u+\gamma)})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

you get

$$=e(g^{a\lambda_i},g^u)\cdot e(H(x)^{-v_ir_i},g^{u})\cdot e(g^{r_i}, g^{u't})\cdot e(g^{r_i},H(x)^{v_iu})\cdot e(g^{r_i},H(x)^{v_i\gamma})\cdot e(g^{r_i}, g^{-tu'})\cdot e(g, H(x)^{v_i\gamma r_i})^{-1}$$

and by rearanging the terms a bit and using bilinearity, the fact that you have a symmetric pairing (switch arguments) and the fact mentioned above you will notice that only the first term remains and that is your desired result.

share|improve this answer
    
You imply that $e(g^a\cdot h^b, g)=e(g^a, g)\cdot e(h^b, g)$. Is this a property of the bilinear map or does this come from somewhere else? I can see now that everything except the first term cancels out. –  Artjom B. Jul 7 at 18:54
    
@Artjom B. Thats simply application of bilinearity. Take as simple example $e(g^n,h)=e(g\cdot\ldots\cdot g,h)=e(g,h)\cdot\ldots\cdot e(g,h)=e(g,h^n)$ (where the dots always expand to $n$ elements\terms). –  DrLecter Jul 7 at 19:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.