2
$\begingroup$

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/845e96c20e5a5ff3b03f4caf72c3cb817a7fa542/pdf

However on page 388 he states the following equality which I don't see why it is true: $F_W(a,P_b,Q_c) = F_W(a,Q_b, P_c)$

where $F_W(x,y,z)= e_m(y,z)^x$. For me the first value of the equality is the inverse of the second one?

$\endgroup$

1 Answer 1

2
$\begingroup$

This does indeed appear to be a typo. Using that $e_m$ is bilinear and alternating, one calculates $$\begin{align*} F_W(a,P_b,Q_c) \;&=\; e_m([b]P,[c]Q)^a \\&=\; e_m(P,Q)^{abc} \\&=\; e_m(Q,P)^{-abc} \\&=\; e_m([b]Q,[c]P)^{-a} \\&=\; F_W(a,Q_b,P_c)^{-1} \text. \end{align*}$$

(However, note that these are only different if the order of $e_m(P,Q))$ does not divide $abc$; in particular, we need $e_m(P,Q)\neq1$.)

$\endgroup$
5
  • $\begingroup$ thank you! that's exactly what I thought! for the second part of your answer notice that P and Q are supposed to be independant ,hence the Weil pairing of these two points is a primitive root of unity. $\endgroup$
    – user28082
    Commented Jun 19, 2016 at 14:26
  • $\begingroup$ I don't see that this is true. Is $e_m(P,Q)=e_m(Q,P)^{-1}$ some inherent property of the Weil pairing? Can you clarify this step? $\endgroup$
    – Artjom B.
    Commented Jun 19, 2016 at 15:00
  • 1
    $\begingroup$ yes this property can be shown to be true for every point of m-torsion. This is called the alternating property. see here: crypto.stanford.edu/pbc/notes/elliptic/weil.html $\endgroup$
    – user28082
    Commented Jun 19, 2016 at 15:11
  • $\begingroup$ I see. So, does this mean that my answer here is wrong? The trick I've used there would also be applicable to this question and would mean that the equality is actually true. $\endgroup$
    – Artjom B.
    Commented Jun 20, 2016 at 13:34
  • $\begingroup$ @ArtjomB. I suppose that by "trick", you refer to writing $H(i)$ as a power of $g$? In that case, the same method is not applicable here: The points $P$ and $Q$ are assumed to be independent, i.e., $e_m(P,Q)\neq1$, and this implies they are not a multiple of the same point by the properties of the Weil pairing. $\endgroup$
    – yyyyyyy
    Commented Jun 26, 2016 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.