Why not compose bilinear maps for higher arity maps?

Question

I understand the only multilinear maps used in cryptography are bilinear maps, and higher arity multilinear maps are not "known." Why does the composition of bilinear maps not yield usable higher-arity maps? I thought the primary feature of multilinear maps in cryptography is simply their multilinearity along with non-degeneracy and efficient computability, so despite restricting to a very small class of multilinear maps (those composed of bilinear maps), those three properties are preserved.

Are my assumptions wrong? Would bilinear maps with appropriate signatures for desired compositions be too difficult to find? What am I missing?

Answer 1

If I understand your question correctly, it is because the bilinear maps that we do know (essentially variants on elliptic curve pairings) have an image space that is distinct from their domain. Specifically, they pair elliptic curve points and output an element of a multiplicative group of a finite field.

To compose the bilinear map, we'd have to take an element of a finite field and treat it as an elliptic curve point in some homomorphic fashion. The only way that I know to do this is to find the discrete logarithm of the finite filed element which is supposed to be hard if the pairing is to be cryptographically secure.