some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would like to know: is there any advantage for a pairing-based scheme?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Pairings in cryptography is a very important tool, the introduction of which has developed a new field, that is pairing-based cryptography.
After the independent pioneering work by Joux and by Sakai et al.("Cryptosystems based on pairing"), many pairing-based crypto-systems emerged. In cryptography, pairings are often treated as "black-box", and then we build all kinds of cryptographic schemes making use of assumed properties of the pairings(e.g. bilinearity, non-degeneracy and computability). However, when it comes to the details of them, they can be very complex, especially the implementation and selection of them. Apparently it's undesirable. So, pairings have very excellent value in theory, but in practice, it's hard to implement them. That is why we need to consider the pairing-free cryptographic systems.
Sometimes, it's not a bad idea to treat pairings as "black-box". In this way, we can ignore the details of them and mainly focus on purely cryptographic aspects of the research. With pairings, we can construct many systems that we don't know how to do it previously, the most typical example is the well-known identity-based encryption by Boneh and Franklin.
In a word, parings just have very high theoretical value, but in the practice of application, we have to consider many details.
If you want to have a good knowledge of this aspect, I recommend you to read this paper "Pairings for Cryptographers"
If you can use something more lightweight than pairings then you should skip pairings. There is a technical property of pairings than is not the case with other crypto primitives. And this is the evaluation of multiplications on the exponent that cannot be achieved in other cases. If you need some sort of summation then you encode in the exponent and then you multiply based on same base.
Check this answer also