2
$\begingroup$

I need to compute a function $h^l$, where h is an element of G2 and l is a rational number. How can this be done using the PBC library?

I have converted the h to an element in G2

As far as I have seen, for exponentiation, PBC has two functions :

element_pow_zn, and
element_pow_mpz

The first function is used when both the operands are of type element_t. The second function will be used when the power is of type mpz_t.

I read in the pbc manual that the mpz_t type is for integers in GMP, while mpq_t is for rationals. Can I use any of the functions in PBC to acquire the required exponentiation? If yes, how will I have to declare the elements?

UPDATE

Will such an initialization work :

mpz_t a, b, l;
element_t ea, eb, el, bi, t1, res;
....after computing a , b, I can use 
element_set_mpz(ea, a);
.
.

element_invert(bi, b);
element_pow_zn(t1, h, a);
element_pow_zn(res, t1, bi);
Improve this question
$\endgroup$
2
  • $\begingroup$ What is G2? $\:$ $\endgroup$
    – user991
    Mar 6, 2013 at 16:36
  • $\begingroup$ The group G^ of the three groups G, G^ and GT, @RickyDemer $\endgroup$
    – Ajoy
    Mar 6, 2013 at 17:05

1 Answer 1

Reset to default
2
$\begingroup$

I don't think $h^l$ where l is a float number is a well defined operation in a finite group, regardless of what context you want to use this group for. A group is a set of elements G with a binary operation $\cdot$ (multiplication) defined, often denoted as (G,$\cdot$) satisfying four properties. You can find more information here: http://mathworld.wolfram.com/Group.html.

Then, exponentiation is defined as repeating multiplication on a group element a certain number of times. For example, $h^n=h\cdot h\cdot h \cdot ... \cdot h$ (repeating $n$ times). So you should be able to see that for example repeating multiplication 3.1415956 times is not well defined.

Specifically, for pairing, G2 is a group over the twist curve. In this group, one operation is defined. Usually, this operation is called point addition. However, in PBC, if you look at the document, it is said that "The addition and multiplication functions perform addition and multiplication operations in rings and fields. For groups of points on an elliptic curve, such as the G1 and G2 groups associated with pairings, both addition and multiplication represent the group operation (and similarly both 0 and 1 represent the identity element). It is recommended that programs choose and one convention and stick with it to avoid confusion." (http://crypto.stanford.edu/pbc/manual/ch04s04.html).

So, the operation you are talking about is not well defined.

Improve this answer
$\endgroup$
5
  • $\begingroup$ Sorry @awaken, I had updated my question. The l is a rational number. Besides, the idea of doing the above operation was my idea, the actual equation is from this paper, pg 14, private-key extraction, lagrange coefficient. Am I doing this right? $\endgroup$
    – Ajoy
    Mar 6, 2013 at 17:48
  • 1
    $\begingroup$ @Ajoy, well, in this case l=a/b. It's not quite a rational number. l=a/b is still some field element. Note that 1/b means the inverse of b in the field finite field where the EC is defined in. So, h^l=h^(a/b)=(h^a)^(1/b). There is a function called element_invert to find the invert of b. This should satisfy your purpose. $\endgroup$
    – Awaken
    Mar 6, 2013 at 18:54
  • $\begingroup$ Thanks @awaken. I did not think of it thus. Well, in that case, how do I initialize the b? For example can b be initialized as element_t? I am not sure how to do this. Initialize b as element_t, then assign some mpz or integer value to it. Could you post some psuedo code too. $\endgroup$
    – Ajoy
    Mar 7, 2013 at 2:43
  • $\begingroup$ I have added a sample code to my question. Is it correct? $\endgroup$
    – Ajoy
    Mar 7, 2013 at 2:59
  • $\begingroup$ Your code above does not show the most important part, where you initialize the elements. The ring $Z_r$ (or sometimes calls $Z_n$) is designed to calculate with exponents. So you have to use the function element_init_Zr() for b and bi and then you can calculate the inverse with element_invert(bi,b). $\endgroup$
    – Ekris
    Mar 7, 2013 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.