As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0.
How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityAs I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0.
How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
For the following explanation, let $e: \mathbb{G}_1 \times \mathbb{G}_2 \rightarrow \mathbb{G}_T$. It depends on the setting you are using whether DDH can hold or not. In the symmetric setting ($\mathbb{G}_1 = \mathbb{G}_2$, i.e., Type 1 pairings) the pairing serves as a DDH oracle for both, $\mathbb{G}_1$ and $\mathbb{G}_2$ and DDH can neither hold in $\mathbb{G}_1$ nor in $\mathbb{G}_2$. In the asymmetric setting, we distinguish two different settings, i.e., Type 2 and Type 3. The important difference in this context is that in the Type 2 setting there exists an isomorphism $\psi: \mathbb{G}_2 \to \mathbb{G}_1$ while such an isomorphism is unknown for the Type 3 setting. Now, in the Type 2 setting, the pairing together with the isomorphism serves as a DDH oracle for $\mathbb{G}_2$, while DDH is assumed to hold in $\mathbb{G}_1$. Finally, in the Type 3 setting, DDH is assumed to hold in both $\mathbb{G}_1$ and $\mathbb{G}_2$.
The particular combination you are asking about is in the Type 1 setting, so DDH can not hold for both source groups of the pairing.
Additional note: In the paper you are citing, actually a group (i.e., $\mathbb{G}_q$) which is independent of the pairing groups is used. In such a setting DDH can of course also hold in $\mathbb{G}_q$. However, using an independent group also means that the order of this group is different to the order of the pairing groups, which makes ZK consistency proofs between elements of the different groups - as required in this paper - quite complicated. I can not find anything in the paper which would address this issue.
There are some groups that have pairings; DDH does not hold in those groups.
But there are also groups in which DDH is believed to hold; of course it means that those groups do not have (known) pairings.