I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the Pairing Based Cryptography Library, there is only a single supersingular elliptic curve implemented, which is a Type A curve. However, he also mentions that type E curves provide the possibility of a symmetric pairing. I am unclear as to how this works, and how to generate such a curve that is a symmetric pairing to be used in schemes like CPABE, as the thesis only explains arbitrary Type E curves.
1
-
$\begingroup$ The usual word for non-supersingular is ordinary. $\endgroup$– minarJul 7, 2013 at 19:10
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
This case for symmetric pairing was mentioned in http://eprint.iacr.org/2001/003.
To sum the results given in that paper, you can get symmetric pairing in a few cases:
- Trace 2 ordinary curves over where $p-1$ is square-free. In this case, the Tate pairing is non-degenerate for all points. Unfortunately, there is no known way to build such curves.
- Trace 2 ordinary curves where $p-1$ contains a large square factor $\ell^2$. These are the Type E curves you mention, which are constructed using complex multiplication. In this case, depending on the considered parameters, there might or might not exist non-zero $\ell$-torsion points $P$ with $e(P,P)=1$. Note that, even when they exists, there are at most $2(\ell-1)$ such points.
- Supersingular curve. Here $e(P,P)=1$ for $P$ defined in the basefield, but you can use a distorsion map $\psi$ and compute $e(P,\psi(P))$. This is the most frequent construction used for symmetric pairings.
