This question is regarding "A Fully Secure Revocable ID-Based Encryption in the Standard Model" - Tung-Tso TSAI, Yuh-Min TSENG, Tsu-Yang WU

The encryption method specifies part of the encryption process to be $\hat e(g_1, g_2)^r \cdot M$ where $g_1$ and $g_2$ are public parameters in cyclic group $G_1$, $\hat e$ is the pairing function and $M$ is the actual message.

My question is what this $\cdot$ operator actually implies for an implementation - is it taking chunks of the $M$ equal to the bit length of the result of $\hat e(g_1, g_2)^r$ and then adding* them together?

*My understanding, perhaps wrongly, is that the multiply operation for elliptic curve groups is addition based on this


Given that the authors (as any sane person should¹) use multiplicative notation for all of the involved groups, "$\cdot$" simply represents the group operation in the target group $G_2$.

It does not seem to be explicitly specified as far as I can tell from skimming the paper, but this implies that the message space of the encryption scheme is exactly $G_2$, meaning that we always have $M\in G_2$. So there are no "chunks" involved.

If you want to encrypt a message directly with the scheme, this means that you will need to encode it as a $G_2$ element. If your message is too long for that, you will need to use one of the standard domain extension techniques, such as using the RIBE as a KEM in a hybrid encryption scheme.

¹This is a hill I'm willing to die on.

| improve this answer | |
  • $\begingroup$ Thanks very helpful. $\endgroup$ – sumo Mar 24 '19 at 0:35
  • $\begingroup$ Any thoughts on how to handle this with asymmetric pairing on a BN curve? With the implementation I'm using M will have to be in GT, is it best to get a random GT and feed the byte representation into a KDF? $\endgroup$ – sumo Apr 14 '19 at 5:53
  • 1
    $\begingroup$ @sumo If you are using the encryption scheme as a KEM, then yes. Choose a uniform element $X\in G_T$ and encrypt it. Then use $KDF(X)$ as a key. $\endgroup$ – Maeher Apr 16 '19 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.