1
$\begingroup$

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a commercial product?

$\endgroup$
  • $\begingroup$ Isn't that "primarily opinion based"? ;) $\endgroup$ – axapaxa May 12 '17 at 14:31
  • $\begingroup$ might be ;)... and what is your opinion? $\endgroup$ – stefanix May 12 '17 at 14:35
  • $\begingroup$ It is also possible to provide an upgrade path; this may not be as black and white as it may seem. $\endgroup$ – Maarten Bodewes May 12 '17 at 15:28
2
$\begingroup$

Pairing-based cryptography has been and is currently used in commercial products sold by Voltage Security, which was recently acquired by HP Enterprise. They seem to have sold the products with a fair amount of success, so there is at least some evidence that a product using pairing-based crypto can work. However, there are two pretty major caveats:

  1. Intellectual property restrictions. HPE owns many patents related to pairing-based crypto, and if you use them without paying a licensing fee you could be the target of a lawsuit.

  2. Cryptanalysis. The hardness assumptions underlying pairing-based crypto are still pretty new and haven't received as much cryptanalytic scrutiny as, say, factoring or ECDLP. This means that choosing parameters for the cryptosystem you're planning to deploy is tricky. For example, a parameter regime you think is offering 128 bits of security could be shown to only offer 80, which is not a very comfortable margin. Changing the parameters after you already have paying customers is difficult at best, and choosing large parameters to account for cryptanalytic advances can make your system slow.

The threat of cryptanalytic attacks is not an abstract one - the situation I described above happened recently to the Zcash anonymous cryptocurrency. If you really want to use pairings in a product I would recommend hiring a consultant who knows the area well to choose the parameters.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.