I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/845e96c20e5a5ff3b03f4caf72c3cb817a7fa542/pdf

However on page 388 he states the following equality which I don't see why it is true: $F_W(a,P_b,Q_c) = F_W(a,Q_b, P_c)$

where $F_W(x,y,z)= e_m(y,z)^x$. For me the first value of the equality is the inverse of the second one?


This does indeed appear to be a typo. Using that $e_m$ is bilinear and alternating, one calculates $$\begin{align*} F_W(a,P_b,Q_c) \;&=\; e_m([b]P,[c]Q)^a \\&=\; e_m(P,Q)^{abc} \\&=\; e_m(Q,P)^{-abc} \\&=\; e_m([b]Q,[c]P)^{-a} \\&=\; F_W(a,Q_b,P_c)^{-1} \text. \end{align*}$$

(However, note that these are only different if the order of $e_m(P,Q))$ does not divide $abc$; in particular, we need $e_m(P,Q)\neq1$.)

| improve this answer | |
  • $\begingroup$ thank you! that's exactly what I thought! for the second part of your answer notice that P and Q are supposed to be independant ,hence the Weil pairing of these two points is a primitive root of unity. $\endgroup$ – user28082 Jun 19 '16 at 14:26
  • $\begingroup$ I don't see that this is true. Is $e_m(P,Q)=e_m(Q,P)^{-1}$ some inherent property of the Weil pairing? Can you clarify this step? $\endgroup$ – Artjom B. Jun 19 '16 at 15:00
  • 1
    $\begingroup$ yes this property can be shown to be true for every point of m-torsion. This is called the alternating property. see here: crypto.stanford.edu/pbc/notes/elliptic/weil.html $\endgroup$ – user28082 Jun 19 '16 at 15:11
  • $\begingroup$ I see. So, does this mean that my answer here is wrong? The trick I've used there would also be applicable to this question and would mean that the equality is actually true. $\endgroup$ – Artjom B. Jun 20 '16 at 13:34
  • $\begingroup$ @ArtjomB. I suppose that by "trick", you refer to writing $H(i)$ as a power of $g$? In that case, the same method is not applicable here: The points $P$ and $Q$ are assumed to be independent, i.e., $e_m(P,Q)\neq1$, and this implies they are not a multiple of the same point by the properties of the Weil pairing. $\endgroup$ – yyyyyyy Jun 26 '16 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.