# Pairings over elliptic curves on rings

Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings here as usual.

Assume that $n = pq$ for $p,q$ primes. I agree with him when he says that the pairing is not computable because the elliptic curve group order is hard to find ($p,q$ are secret), hence we cannot apply Miller's algorithm.

Very trivial idea: Keep $p,q$ still secret but publicly expose the order of the elliptic curve group (which can be found by the one that knows $p,q$).

What would be the problem in this case?

• There may be a way to factor $n$ when given the curve order. – SEJPM Dec 4 '17 at 19:41
• @SEJPM does there exist a reference somewhere of such an attack ? – cehptr Dec 4 '17 at 19:42
• I only suspect there to maybe some attack like that, but I don't actually know (or else I probably would have answered). – SEJPM Dec 4 '17 at 19:43
• The term "non-prime field" refers to fields that are not prime, i.e., not $\mathbf{Q}$ or $\mathbf{Z}/p\mathbf{Z}$ for a prime $p$. Here you mean "non-fields". – fkraiem Dec 5 '17 at 0:23
• What exactly do you mean by problem? As far as I can see the whole point of Boneh is that the pairing is not computable, making the DDH hard. – CurveEnthusiast Dec 5 '17 at 0:34