2
$\begingroup$

The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and $e:\mathbb{G}_1\times\mathbb{G}_2\rightarrow\mathbb{G}_T$.

Why are they different and are there reasons to prefer one over the other? Are they fixed in their purpose?

$\endgroup$
3
  • 1
    $\begingroup$ Where did you get these definitions? The only difference is that the first is written additively (which is what it is since it is elliptic curves). The second is written multiplicatively (which some authors use for consistency). They are the same though. $\endgroup$
    – mikeazo
    Commented Apr 24, 2014 at 17:50
  • $\begingroup$ Hadn't thought about checking that $aP=P^a$ $\endgroup$
    – Artjom B.
    Commented Apr 24, 2014 at 18:02
  • 2
    $\begingroup$ Let me explain clearer $aP\neq P^a$. It is just a notational choice by the authors of the papers you are looking at. Some prefer to write things multiplicatively, others choose to write it additively. $\endgroup$
    – mikeazo
    Commented Apr 24, 2014 at 18:07

1 Answer 1

5
$\begingroup$

There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write it additively $e(aP,bQ)=e(P,Q)^{ab}$.

This comes from the fact that in $e : \mathbb{G}_1\times \mathbb{G}_2\to\mathbb{G}_T$, $\mathbb{G}_1$ and $\mathbb{G}_2$ are (typically) elliptic curve groups, in which the group operation is additive, while $\mathbb{G}_T$ is a multiplicative group. Thus some authors might prefer to make the additive notation of the elliptic curve groups more explicit while other others prefer to make the notation more consistent.

$\endgroup$
3
  • $\begingroup$ So the most meaningful notation would be $e(aP,bQ)=ab\cdot e(P,Q)$ as you cannot multiply two curve points together which the other notations imply. $\endgroup$
    – Artjom B.
    Commented Apr 24, 2014 at 20:05
  • 2
    $\begingroup$ No, the pairing maps to $G_T$, which is always a multiplicative group. $\endgroup$
    – DrLecter
    Commented Apr 24, 2014 at 20:08
  • $\begingroup$ @artjomb the target group is not an elliptic curve group. $\endgroup$
    – mikeazo
    Commented Apr 24, 2014 at 23:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.