1
$\begingroup$

For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic operations are evaluated on the ciphertext) or $G_1$ (when one multiplication applies). In such a setting, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ (the target group in bilinear map) but not able to decrypt the ciphertexts in $G$?

$\endgroup$
1
  • $\begingroup$ I use the same notations as in Boneh's paper, that is, $G_1$ is the target group where $e: G \times G \rightarrow G_1$ is a bilinear map. $\endgroup$
    – phan
    Sep 17 '15 at 13:53
1
$\begingroup$

No, because the guy who can only decrypt in the target group $G_1$ can take any ciphertext in $G$, use the pairing to map it to $G_1$ and then decrypt in $G_1$ (here I assume the full scheme where the message is a number and not a group element).

You could do it the other way round, i.e., let the guy only decrypt in $G$ and not in $G_1$, by giving him not the full private key $q_1$ but only $g^{q_1}$. Then you force him to decrypt by using a pairing and thus force the ciphertext to be in $G$.

$\endgroup$
2
  • $\begingroup$ If we assume that the guy does not know the `public key' (he cannot generate any chipertext by himself), does he also be able to use the pairing? $\endgroup$
    – phan
    Sep 17 '15 at 15:32
  • $\begingroup$ That doesnt matter. If he knows the bilinear group parameters (which are public) he can map any element from $G$ to $G_1$ (by just pairing it with the generator $g$ of $G$ which is contained in the bilinear group description). $\endgroup$
    – DrLecter
    Sep 17 '15 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.