In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ but not able to decrypt the ciphertexts in $G$?

For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic operations are evaluated on the ciphertext) or $G_1$ (when one multiplication applies). In such a setting, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ (the target group in bilinear map) but not able to decrypt the ciphertexts in $G$?

• I use the same notations as in Boneh's paper, that is, $G_1$ is the target group where $e: G \times G \rightarrow G_1$ is a bilinear map.
– phan
Sep 17 '15 at 13:53

No, because the guy who can only decrypt in the target group $G_1$ can take any ciphertext in $G$, use the pairing to map it to $G_1$ and then decrypt in $G_1$ (here I assume the full scheme where the message is a number and not a group element).

You could do it the other way round, i.e., let the guy only decrypt in $G$ and not in $G_1$, by giving him not the full private key $q_1$ but only $g^{q_1}$. Then you force him to decrypt by using a pairing and thus force the ciphertext to be in $G$.

• If we assume that the guy does not know the `public key' (he cannot generate any chipertext by himself), does he also be able to use the pairing?
– phan
Sep 17 '15 at 15:32
• That doesnt matter. If he knows the bilinear group parameters (which are public) he can map any element from $G$ to $G_1$ (by just pairing it with the generator $g$ of $G$ which is contained in the bilinear group description). Sep 17 '15 at 17:22