Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

learn more… | top users | synonyms

0
votes
1answer
55 views

Multilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $$e_1:G_0 \times G_0 \rightarrow G_1$$ $$e_2:G_1 \times G_1 \rightarrow G_T$$ and use this to encrypt a message $M$ in the form $$M ...
0
votes
0answers
34 views

Weil Pairing - Miller's Algorithm

I'm trying to implement Weil Pairing using Miller's algorithm. I have got couple of questions. How to select $m$? As stated in this link page 13, I interated from $1$ to order of point $P$ such that ...
0
votes
2answers
50 views
0
votes
1answer
15 views

Create composite group for pairing in JPBC

We use bilinear map $S = (G, G_T , e(\cdot, \cdot))$ of composite order $n = s \times n'$ with two subgroups $G_s$ and $G_n'$ of $G$. Random generators $w \in G$, $g \in G_s$, and $φ \in G_n'$ are ...
2
votes
1answer
254 views

Security proof in pairing based cryptography

Let : $G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map, $e : G_0 \times G_0 → G_1$ and let $𝐶_{1} = ...
2
votes
1answer
109 views

How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
1
vote
1answer
71 views

the decryptNode function for leaf nodes in CP-ABE

can someone please explain to me why decryptNode gives as result e(g,g)^rq(0) for leaf nodes, i don't understand how they went from the sconde step to the third ...
1
vote
1answer
95 views

Exponent operation over element of G

I found a definition of an exponent operation over the element of $\mathbb{G}$ in this paper (page 4): $$ (g^a)^{\% b} = g ^{a \text{ mod } b}$$ I couldn't understand the rest of the paper (Decrypt ...
2
votes
2answers
139 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
-1
votes
0answers
24 views

Pairing on BN curves, GMP code

Is it possible to write a small implementation of tate pairing using BN curves using GMP. It does not need to be efficient. I just want to understand the steps. Thank you.
0
votes
3answers
67 views

What is the time requirement for pairing computation and modular exponentiation?

I want to design a cryptographic protocol for encrypted search without pairing. I have seen some papers for protocols without pairing. How would I compare pairing computation and modular operations?
0
votes
2answers
74 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
0
votes
0answers
27 views

Security for this scheme or not in pairing

Let be $G_{1}$and $G_{2}$ cyclic groups of prime order $q$ and $g =<G1>$ and $h=<G2>$ the generators of these groups. Let's consider the following protocol: Select $s \leftarrow ...
-1
votes
0answers
22 views

Does security exists in this pairing-based encryption scheme [duplicate]

Consider G1,G2 be cyclic group of prime order p. g =generator of G1 ,G1=generator of G2 public key PK=g^s Assume (PK,g1,p) is made public. x←1,,2,...,p y←1,,2,...,p Private key for user a=x Private ...
1
vote
1answer
59 views

Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in ...
1
vote
1answer
39 views

Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
4
votes
0answers
47 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
1
vote
1answer
58 views

How to calculate secret key size of a CP-ABE scheme

How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme: Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for ...
-1
votes
1answer
44 views

Security for secret key of server in Identity-based Encryption

In the key set up phase, server generates Pub=s.P, where s is the secret key.Then , it gives clients Pub,P as public parameters and pairing descriptions. Is it possible for clients to pre-compute r.P ...
3
votes
0answers
32 views

no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
0
votes
1answer
92 views

pairing parameters in PBC library

I would like to know what are the pairing parameters of PBC library and what are they used for? Here an example where they are used. I noticed that we can give any file in the param subdirectory. Is ...
1
vote
0answers
70 views

PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
2
votes
1answer
48 views

Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
3
votes
1answer
159 views

Concrete example of Weil Pairing

I am trying to find a concrete example of the Weil Pairing. What I have done until now is that I took $E=(x-1)(x-2)(x-3)$ over $F_5$. I took $E[2]=\{\infty,(1,0),(2,0),(3,0)\}$. I know that there ...
4
votes
2answers
104 views

How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
2
votes
1answer
243 views

Pairings in Identity-based encryption vs. Attribute-based encryption

The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and ...
2
votes
1answer
102 views

Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve ...
2
votes
0answers
50 views

can pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...
2
votes
0answers
47 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm ...
4
votes
3answers
756 views

When do we need composite order groups for bilinear maps and when prime order?

Why we need bilinear groups of composite order? What's the special security property of the composite order group in comparison with one of prime order? To put it in another way when do we need ...
1
vote
0answers
31 views

Why the group order has to be prime for pairing-based cryptography [duplicate]

I'm trying to get into pairing-based cryptography and I don't see why the group order of the group G in the pairing function e:G*G-> G_t has to be a prime number. I don't find an argument why ...
1
vote
1answer
44 views

Sextic twist maps to q Eigenspace of Frobenius

Let $E(p)$ be a Barretto-Naehrig elliptic curve with r-torsion and embedding degree 12 and $E'$ a sextic twist with homomorphism $\psi$. How to show, that $E'$ has a unique r-torsion group $\psi$ ...
2
votes
0answers
42 views

Are the values of Tate and Ate pairing the same?

Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup. Do then the ...
1
vote
1answer
42 views

In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ but not able to decrypt the ciphertexts in $G$?

For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic ...
0
votes
1answer
127 views

How to compute accumulated values in bilinear map accumulators

How to compute $ g^{1/(e_1+s)}$, where $g$ is the generator of group $\mathbb G$, and $e_1$ and $s$ are keys? I know only $s$ and $g^{e_1}$, not $e_1$. $\mathbb G$ has prime order for some prime $p$ ...
1
vote
0answers
43 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...
0
votes
1answer
78 views

Does the following linear equation hold in bilinear pairings?

Does the following hold in bilinear pairings? $$e(g^{a_1x_1}g^{a_2x_2},g^{c_1}g^{c_2})=e(g^{x_1+x_2},g^{a_1a_2(c_1+c_2)})$$
2
votes
1answer
86 views

Decryption of message in IBE without random oracle using bilinear pairing registration?

I find the following IBE scheme from the videos posted and i don't understand the decryption algorithm, will any one please elaborate the 6th step scheme Setup($\lambda$) : $(\mathbb{G}, ...
16
votes
1answer
990 views

Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
1
vote
1answer
42 views

Question on Miller's algorithm (change the input m)

From the book titled " An Introduction to Mathematical Cryptography" (Chapter 5,page 322), we know that the miller's algorithm returns a function $f_P$ whose divisor satisfies $$div(f_P) ...
0
votes
0answers
52 views

Type of values that can be accumulated in bilinear map (multiplicative) accumulator reg.

Is there any restriction that the members to be accumulated in bilinear map (multiplicative) accumulator need to be relatively prime to P? Where P is the order of group.
1
vote
2answers
980 views

Is it an example of bilinear pairing?

Consider a bilinear pairing $e: G_1 \times G_2 \rightarrow G_T$. Let's assume, $G_1 = G_2 = G_T = (\mathbb{Z}_n,+)$, i.e. additive group of integer modulo $n$ and $e(x,y) = xy$ mod $n$. Isn't it an ...
0
votes
1answer
71 views

What is more efficient, pairing based cryptography or non pairing based cryptography? [closed]

As far as I know non pairing pairing based cryptography is less time consuming than pairing based because, pairing based uses complex operations. Are there any advantages of pairing based cryptography ...
0
votes
0answers
403 views

Variant of the Decisional Bilinear Diffie Hellman problem

I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let $e: \mathbb G_1 ...
4
votes
1answer
531 views

Blockwise Montgomery multiplication

I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ...
0
votes
0answers
65 views

Anyone familiar with domain of hash functions in bilinear pairing based system?

I need a clarification regarding domain of hash functions. I have defined a bilinear pairing based system as follows: Let G1 and G2 be cyclic multiplicative groups of prime order p generated by g1 ...
0
votes
0answers
66 views

Bilinear pairing arithmetic - cryptographic accumulators

For calculating accumulated values for set of elements chosen randomly from say $ { e_1 ,e_2,...e_n}\varepsilon X $ we use the formula $acc= g^{f(e,s)}$ where $ f(e,s)= (e_1+s)(e_2+s).....(e_n+s)$ ...
0
votes
0answers
23 views

Type 1 pairings and encoding function from $\mathbb G_T$ to $\mathbb G$

Let $e : \mathbb G \times \mathbb G \to \mathbb G_T$ be a Type 1 bilinear pairing. Is it possible to define an encoding function $E : \mathbb G_T \to \mathbb G$? If so, how could this encoding ...
4
votes
1answer
220 views

Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?

where $g$ is a group element in bilinear group $\mathbb{G}$. I understand it is very similar to the conventional DBDH problem, but $g^{1/b}$ is also known, possibly making it easier? Does anyone know ...
1
vote
1answer
94 views

Bilinear pairing arithmetic

Is this $e(g^x,g^yH^z) = e(g^x,g^y)e(g^x,H^z)$ expression is true? where $ g$ is the generator and $ H \in G $