Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings here as usual.

Assume that $n = pq$ for $p,q$ primes. I agree with him when he says that the pairing is not computable because the elliptic curve group order is hard to find ($p,q$ are secret), hence we cannot apply Miller's algorithm.

Very trivial idea: Keep $p,q$ still secret but publicly expose the order of the elliptic curve group (which can be found by the one that knows $p,q$).

What would be the problem in this case?

  • 1
    $\begingroup$ There may be a way to factor $n$ when given the curve order. $\endgroup$ – SEJPM Dec 4 '17 at 19:41
  • $\begingroup$ @SEJPM does there exist a reference somewhere of such an attack ? $\endgroup$ – cehptr Dec 4 '17 at 19:42
  • $\begingroup$ I only suspect there to maybe some attack like that, but I don't actually know (or else I probably would have answered). $\endgroup$ – SEJPM Dec 4 '17 at 19:43
  • $\begingroup$ The term "non-prime field" refers to fields that are not prime, i.e., not $\mathbf{Q}$ or $\mathbf{Z}/p\mathbf{Z}$ for a prime $p$. Here you mean "non-fields". $\endgroup$ – fkraiem Dec 5 '17 at 0:23
  • 1
    $\begingroup$ What exactly do you mean by problem? As far as I can see the whole point of Boneh is that the pairing is not computable, making the DDH hard. $\endgroup$ – CurveEnthusiast Dec 5 '17 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.