Given a generator $g$ of a cyclic group, I am trying to look for a case where I use pairing over an element that has an exponent which is a one-way function, e.g., $g^{x^2\mod n}$ (here $x$ in the exponent is hard to compute by the quadratic residue assumption), where $n=pq$, for primes $p$ and $q$. For instance, to check if $e(g_1^{x^2\mod n},g_2) = e(g_1^{x\mod n},g_2^{x\mod n})$.

However, I am not sure if this is secure as in the definition of pairing $G_0$, $G_1$, and $G_T$ need to be cyclic groups of some prime order $q$ where $g_0\in G_0$ and $g_1 \in G_1$ are generators. In my case, the exponent is square mod $pq$. On the other hand, I saw that in BGN cryptosystem, the randomness in the ciphertext is coming from $(1,...,n)$ where $n=pq$ (and BGN uses pairing for performing multiplicative homomorphism). so I am confused about the restrictions of using pairing safely.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.