1
$\begingroup$

Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$

$X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public.
$m,n,r$ are randomly chosen from $Z_q$.
Anybody who knows $(1/r)$ can easily get $R=e(X,Y)^{\frac{1}{r}}$.
Can I use computational diffie hellman problem by assuming $$X=g^x, Y=g^y$$, then finding $g^yx$.
Because in authenticated identity-based encryption by Ben Lynn, authenticated key $$K= e(H(ID_A),H(ID_B))^s$$ is assumed to be secure if the CDH problem is hard.In this case, $H(ID_A),H(ID_B)$ is declared as public.
Which one is better, guessing problem or computational diffie hellman problem?

$\endgroup$
1
$\begingroup$

Well, the problem "given $X, Y$, recover $R$" is impossible, even to a computationally unbounded adversary. The reason is that any value of the form $e(X, Y)^k$ is possible; for any set of nonzero values for $X, Y, n, m, k$, there exists values for $r, P, Q$ that is consistent with the observed $X, Y$ values, and which $R=e(X,Y)^k$

However, that is unlikely to be the only way to attack this system; as stated, your system is informationally secure (in that the attacker literally doesn't have enough information to attack the system), and that is quite rare in cryptography. Most likely there is some additional information that is available to the attacker; what this information is is vitally important in deciding on the security of the system.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.