New answers tagged

1

I had to do this comparison one year ago in an article, to justify whether it was desirable to avoid pairings in some protocols. Roughly, if you take the (arguably) most efficient up-to-date curves with and without pairing, counting as 1 the cost of a modular exponentiation in the curve without pairing, denoting $\mathbb{G}_1$ and $\mathbb{G}_2$ the ...


3

First of all, let us simplify the equation by replacing things that the attacker can compute with known constants. We come up with: $$a \cdot b^x = y$$ where the attacker knows $a$ (which is $e(g,h)^k$) and $b$ (which is $e(g, h)$, which he can compute, as he knows $g, h$), and the attacker solves for $x, y$. If it is sufficient for an attacker to find a ...


2

I am really not sure about what you are trying to do. If you simply want to prove that $Ans = e(g,h)^k \times e(g,h)^r$ is hidden given only $(g,h,e(g,h)^k)$, then this is trivial and does not require any hypothesis at all (in particular, no discrete logarithm problem is involved). Indeed, this is perfectly equivalent to the problem of finding $e(g,h)^r$ ...



Top 50 recent answers are included