Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I need to compute a function $h^l$, where h is an element of G2 and l is a rational number. How can this be done using the PBC library?

I have converted the h to an element in G2

As far as I have seen, for exponentiation, PBC has two functions :

element_pow_zn, and
element_pow_mpz

The first function is used when both the operands are of type element_t. The second function will be used when the power is of type mpz_t.

I read in the pbc manual that the mpz_t type is for integers in GMP, while mpq_t is for rationals. Can I use any of the functions in PBC to acquire the required exponentiation? If yes, how will I have to declare the elements?

UPDATE

Will such an initialization work :

mpz_t a, b, l;
element_t ea, eb, el, bi, t1, res;
....after computing a , b, I can use 
element_set_mpz(ea, a);
.
.

element_invert(bi, b);
element_pow_zn(t1, h, a);
element_pow_zn(res, t1, bi);
share|improve this question
    
What is G2? $\:$ –  Ricky Demer Mar 6 '13 at 16:36
    
The group G^ of the three groups G, G^ and GT, @RickyDemer –  Ajoy Mar 6 '13 at 17:05

1 Answer 1

up vote 2 down vote accepted

I don't think $h^l$ where l is a float number is a well defined operation in a finite group, regardless of what context you want to use this group for. A group is a set of elements G with a binary operation $\cdot$ (multiplication) defined, often denoted as (G,$\cdot$) satisfying four properties. You can find more information here: http://mathworld.wolfram.com/Group.html.

Then, exponentiation is defined as repeating multiplication on a group element a certain number of times. For example, $h^n=h\cdot h\cdot h \cdot ... \cdot h$ (repeating $n$ times). So you should be able to see that for example repeating multiplication 3.1415956 times is not well defined.

Specifically, for pairing, G2 is a group over the twist curve. In this group, one operation is defined. Usually, this operation is called point addition. However, in PBC, if you look at the document, it is said that "The addition and multiplication functions perform addition and multiplication operations in rings and fields. For groups of points on an elliptic curve, such as the G1 and G2 groups associated with pairings, both addition and multiplication represent the group operation (and similarly both 0 and 1 represent the identity element). It is recommended that programs choose and one convention and stick with it to avoid confusion." (http://crypto.stanford.edu/pbc/manual/ch04s04.html).

So, the operation you are talking about is not well defined.

share|improve this answer
    
Sorry @awaken, I had updated my question. The l is a rational number. Besides, the idea of doing the above operation was my idea, the actual equation is from this paper, pg 14, private-key extraction, lagrange coefficient. Am I doing this right? –  Ajoy Mar 6 '13 at 17:48
1  
@Ajoy, well, in this case l=a/b. It's not quite a rational number. l=a/b is still some field element. Note that 1/b means the inverse of b in the field finite field where the EC is defined in. So, h^l=h^(a/b)=(h^a)^(1/b). There is a function called element_invert to find the invert of b. This should satisfy your purpose. –  Awaken Mar 6 '13 at 18:54
    
Thanks @awaken. I did not think of it thus. Well, in that case, how do I initialize the b? For example can b be initialized as element_t? I am not sure how to do this. Initialize b as element_t, then assign some mpz or integer value to it. Could you post some psuedo code too. –  Ajoy Mar 7 '13 at 2:43
    
I have added a sample code to my question. Is it correct? –  Ajoy Mar 7 '13 at 2:59
    
Your code above does not show the most important part, where you initialize the elements. The ring $Z_r$ (or sometimes calls $Z_n$) is designed to calculate with exponents. So you have to use the function element_init_Zr() for b and bi and then you can calculate the inverse with element_invert(bi,b). –  Ekris Mar 7 '13 at 10:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.