I was reading the paper by Boneh et al. Link. The scheme describes what is called a Verifier Local Revocation Technique. The Scheme assumes that a Revocation List [RL] allows each verifier to check the validity of the signature. The revocation check works as follows:

  • $e(T_2/A,\hat{u}) =^{?}e(T_1,\hat{v})$, Given $T_1 = A_iv^\alpha,T_2 = u^\alpha$
  • $e(A_iv^\alpha/A,\hat{u}) =^{?}e(u^\alpha,\hat{v})$

In the case that $A_i\in$[RL], $A = A_i$, then,

  • $e(v^\alpha,\hat{u}) =^{?}e(u^\alpha,\hat{v})$

The author then claims that these pairings are equal, The $(\hat{u},\hat{v})$ are generated as follows:

  • $(\hat{u},\hat{v}) \leftarrow H_0 = (gpk,M,r) \in G_2^2$ , Given that:
  • $u\leftarrow\psi(\hat{u})$, $v\leftarrow\psi(\hat{v})$,

I have three questions:

  1. Why the $(\hat{u},\hat{v}) \in G_2^2$ not $G_2$.
  2. What is the Hash Function that generates two parameters and is there a relation between them?
  3. How the check $e(v^\alpha,\hat{u}) =^{?}e(u^\alpha,\hat{v})$ is valid.

1 Answer 1


I do not have access to the paper you have linked, but I certanly can answer the first question and maybe answer the third question:

  1. $(\hat{u}, \hat{v}) \in G_2^2$ is a short version of $(\hat{u}, \hat{v}) \in (G_2 \times G_2)$ which is a short version of "$\hat{u} \in G_2$ and $\hat{v} \in G_2$".

  2. Since I don't have access to the paper I'm gonna make some assumptions to answer the third question:

    • $e$ is a bi-linear mapping of the form $G_1 \times G_2 \rightarrow G_3$. I make this assumption based on the fact the second parameter is element of a group called $G_2$ which hints at the existence of a group $G_1$.
    • $\psi$ is a linear homomorphism from $G_2$ to $G_1$. This would make sense as the first parameter of $e$ would be an element of $G_1$ under the first assumption. Also $\psi(g_2)$ must be $g_1$ for the math below to check out.

Be $x, y \in Z_q$ with $\hat{u} = g_2^x$ and $\hat{v} = g_2^y$, then $u = g_1^x$ and $v = g_1^y$ since $\psi(g_2) = g_1$. This leads to:

$e(v^{\alpha}, \hat{u}) = e((g_1^y)^{\alpha}, g_2)^x = e(g_1^{\alpha y}, g_2)^x = e(g_1, g_2)^{(\alpha y) x} = e(g_1, g_2)^{(\alpha x) y} = e(g_1 ^ {\alpha x}, g_2^y) = e((g_1^x)^{\alpha}, g_2^y) = e(u^{\alpha}, \hat{v})$

AS stated above, this only works under the assumptions above, which are assumptions. If these are not correct feel free to leave a comment or edit.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.