Assume that we have an already assigned Multiplicative Cyclic Group $\mathbb Z_p^*$ with order $q=p-1$, and $p$ is a prime number, is it possible to create a bilinear function $\hat{e}: \mathbb Z_p^* \times \mathbb Z_p^* \rightarrow \mathbb G_2$ with the property that follows:


$g$ is a generator for $\mathbb Z_p^*$, and $\mathbb G_2$ is also a Multiplicative Cyclic Group with order $q$

it seems that if the creation of this function is practical in polynomial time then there should be new attacks on some cryptographic protocols with security property of anonymity.

  • $\begingroup$ You might have to add more information about the properties of the groups you are referring to. It is already known that the discrete logarithm problem is easier to solve in some groups, than it is other groups. $\endgroup$ Mar 1, 2013 at 17:42

1 Answer 1


If you can find such an efficiently computable function (other than the trivial solution $\hat{e}( x, y ) = 1\ \ $ for all $x$, $y$), then you have shown that the decisional Diffie-Hellman problem is easy. That is, given $g$, $g^a$, $g^b$, $g^c$, you can check whether

$$ab = c$$

simply by testing:

$$\hat{e}( g^a, g^b ) = \hat{e}( g, g^c)$$

The decisional Diffie-Hellman problem is believed to be hard in appropriately sized Multiplicative Cyclic groups, hence we believe that there is no such efficiently computable $\hat{e}$

  • $\begingroup$ Given the formula in the question, I think you have to set $xy=z$, $x=a$, $y=sb$, $b=z=xy$ and consequently $s=x^{-1}$, and get $e(g^x,g^y)=e(g^z,g)$ which is equivalent to what you write in your second edit. However, doesn't this require either x or y to be invertible $\mod p-1$? $\endgroup$ Mar 1, 2013 at 22:32
  • $\begingroup$ @HenrickHellström: no, you have $a=x$, $b=1$, $s=y$; plugging those into the property gives $\hat{e}(g^x, g^y) = \hat{e}(g, g^{xy})$. If they are both $\hat{e}(g, g^z)$, that indicates that $g^{xy} = g^z$ $\endgroup$
    – poncho
    Mar 1, 2013 at 22:57
  • $\begingroup$ poncho's answer is acceptable for me, but for addition I want to add that the DDH problem does NOT hold for $\mathbb Z_p^*$ but it holds for some sub groups of $\mathbb Z_p^*$ for more information take a look at: link $\endgroup$
    – Habib
    Mar 2, 2013 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.