# Security proof in pairing based cryptography

Let :

$G_{0}$ and $G_{1}$ be two multiplicative cyclic groups of prime order $p$, $g$ be a generator of $G_{0}$ and $e$ be a bilinear map,

$e : G_0 \times G_0 → G_1$

and let $𝐶_{1} = 𝑔^{𝛽𝑠_{1}}$, $𝐶_{2} = 𝑔^{𝛽𝑠_{2}}$ , ... , $𝐶_{𝑛}= 𝑔^{𝛽𝑠_{𝑛}}$; $𝐷=𝑔^{(𝛼+𝑟)/𝛽}$

such that $\alpha, \beta, r, s_{1}, s_{2}, ..., s_{n} \in Z_{p}$

Given $s_{x} \in Z_{p}$ ($x \neq i, i=1, ..., n$), and knowing $e\left( C_{1}, D\right), e\left( C_{2}, D\right), ..., e\left( C_{n}, D\right)$. I would like to know if it is possible to compute the value of $e(C_{x},D)$ and/or $D$.

Secret elements: $D$, $e(C_{x},D)$.

Public elements: $𝐶_{1}$, $𝐶_{2}$, ..., $𝐶_{n}$, $𝐶_{x}$, $e(C_{1},D)$, $e(C_{2},D)$, ..., $e(C_{n},D)$.

If it is not possible, how to prove that?

• what is $C_x$? Of course if you know $C_x$.What is known to the attacker?What is public and secret? May 5, 2015 at 10:39
• In my question, the value of $D$ is kept secret. May 5, 2015 at 10:43
• @curious : I have just updated my question. May 5, 2015 at 10:47
• I think your question is a bit difficult to read because your notation is more difficult than necessary. If you want, you can also write such things just saying like: "Knowing $g^a,g^b$, is it possible to compute $g^{ab}$?". So you don't need all the $C$s and the $D$s. (But I would not change the current question now.) Sep 2, 2015 at 18:52

The only way i can see to evaluate $e(C_x,D)$ is to recover $D$ from a previous known pairing $e(C_i,D)$. However due to the Fixed Argument Pairing Inversion 1 assumption this is computationally hard.
• you could try to find a relation between $C_x$ and the $C_i$ which will be translated into $G_1$ May 5, 2015 at 12:53
• @FlorianBourse even if there is a correlation in $C_x-C_i$, still you have to recover D May 5, 2015 at 14:42