Let $e: G^{\dagger}_{1} \times G_{2} \mapsto G_{T}$ define the pairing. Assuming an output $\sigma = (c, p)$ similar to a Schnorr signature:

  1. $s \times Y \mapsto Y_{s}$ and $m \times G \mapsto M$
  2. $c = H(Y_{s}||M||B)$
  3. $p \times Y = M + c \times Y_{s}$

However, with additional requirements:

  1. $p$ is a static secret, where $p \times G^{\dagger} \mapsto P^{\dagger}$ and $P^{\dagger}$ is public.
  2. $Y$ is a base point that can change such that $y = m \cdot (p - c \cdot s)^{-1}$ and $y \times G \mapsto Y$.

Can we use PBC in Symmetric-XDH settings for an alternative verification only giving the result $Y$ and knowing $(Y_{s}, M, B)$ ?

  1. $c = H(Y_{s}||M||B)$
  2. $e(P^{\dagger}, Y) \stackrel{?}{=} e(G^{\dagger}, M) \cdot e(G^{\dagger}, Y_{s})^{c}$

If we assume that $P^{\dagger}$ is static forcing also $p$ to be static. Is there a way to forge such scheme?

For an adversary, there is a sequence of events where he must know $(Y_{s}, M)$ to derive $c$. But those must be selected to result in $p \times Y$ !


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.