0
$\begingroup$

$$P\in G_1$$$$Q\in G_1$$ $$a,b \in Z_q$$ $G_1$ isadditive cyclic group of prime order $q$
$$e(P^{a+b},Q)------(1)$$ $$e(aP+bP,Q)----(2)$$ (1) and (2) will give the same pairing result $e(P,Q)^{a+b}$.
In (1) and (2), despite of same pairing result, is there difference in terms of security or performance for different operations (exponentiation, multiplication and addition) in $P$?
In (1), I don't know clearly about exponentiation is allowed or not with randomly generated $P$ value from additive group.

$\endgroup$
  • $\begingroup$ A reference would help, where those terms are used. Actually, I think you placed the exponent in term $(1)$ at the wrong position, it would make more sense to have $e(P,Q)^{a+b}$, where the notation in the target group $e(.,.)$ is written multiplicatively. $\endgroup$ – tylo Oct 10 '16 at 16:53
  • $\begingroup$ @tylo. Yes, I know the result will be equal to $e(P,Q)^{a+b}$. I wanna emphasis on how $P$ is differently prepared. (1)Using exponentiation(2) using multiplication and addition. I wanna know security or performance difference for those two preparations. $\endgroup$ – peterpe Oct 10 '16 at 17:01
  • $\begingroup$ It seems to me, that they are not different operations, they are just different kinds of notation. Differences in notation make no difference for the actual computation. But you are actually wrong: You can not use both multiplicative and additive notation for the same group. So no, your statement is actually wrong. Besides, you should probably think less about actual operations. Pairing based crypto is realized in elliptic curves, and the group operation is not just simple addition, multiplication or exponentiation modulo some number. $\endgroup$ – tylo Oct 10 '16 at 17:29
  • $\begingroup$ Tylo is wright in the sense that $P^{a+b}$ is not defined. P is an element of an additive Group, generally speakin the group of points of EC. $\endgroup$ – Robert NACIRI Oct 10 '16 at 18:03
  • $\begingroup$ @RobertNACIRI. Do you mean that exponentiation cannot be used for additive group element $P$? $\endgroup$ – peterpe Oct 10 '16 at 18:06
2
$\begingroup$

The problem is that you are comparing apples and oranges. A group has a single operation associated to it. Depending on your notational conventions you either need to write (1) $e((a+b)P,Q)$ and (2) $e(aP+bP,Q)$ if you write $G_1$ additively or (1) $e(P^{a+b},Q)$ and (2) $e(P^a \cdot P^b,Q)$ if you write $G_1$ multiplicatively. The cost of computing $(a+b)P$ or $aP+bP$ depends on your approach to scalar multiplication, but typically the former approach will be more efficient.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.