# Tagged Questions

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

170 views

### System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
41 views

### Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference? Many Thanks
115 views

### Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve ...
45 views

### Create composite group for pairing in JPBC

We use bilinear map $S = (G, G_T , e(\cdot, \cdot))$ of composite order $n = s \times n'$ with two subgroups $G_s$ and $G_n'$ of $G$. Random generators $w \in G$, $g \in G_s$, and $φ \in G_n'$ are ...
79 views

### How to define order according to domain parameters in elliptic curve pairing groups

According to domain parameters, as an example Type 1 pairing domain parameters are ...
56 views

### How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
33 views

### no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
91 views

### Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking). Specifically this scheme: If you look at the ...
30 views

### Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
50 views

### can pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...
50 views

280 views

### Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
77 views

### For $e(g, d) = c$, can we compute $d$, given others

Given $$e(g, d) = c$$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
97 views

### BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
169 views

63 views

### DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
174 views

### Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...
141 views

### A question about elliptic curves and finite fields in bilinear pairings

Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ...
154 views

### Bilinear pairing

I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are point doubling and line function computation point addition ...
104 views

### Why does computing g^a * g^{-a} with the PBC library result in zero?

My example code is as follows: /* * Example 1 * 1) Calculate g^a * 2) calculate g^{-a} * 3) multiply g^a * g^{-a} * */ Note: here ...
110 views

### Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
44 views

### Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
39 views

### Has anybody implemented BGN cryptosystem to multiply two plain texts?

I have tried to use this code as follows, http://stackoverflow.com/questions/33581962/bgn-implementation-in-java but the issue is, when it generate the pairing, the output is in GTfiniteelement (for ...
56 views

### Weil Pairing - Miller's Algorithm

I'm trying to implement Weil Pairing using Miller's algorithm. I have got couple of questions. How to select $m$? As stated in this link page 13, I interated from $1$ to order of point $P$ such that ...
54 views

### Type of values that can be accumulated in bilinear map (multiplicative) accumulator reg.

Is there any restriction that the members to be accumulated in bilinear map (multiplicative) accumulator need to be relatively prime to P? Where P is the order of group.
For calculating accumulated values for set of elements chosen randomly from say ${ e_1 ,e_2,...e_n}\varepsilon X$ we use the formula $acc= g^{f(e,s)}$ where $f(e,s)= (e_1+s)(e_2+s).....(e_n+s)$ ...