I seeing a paper about Elliptic curve based proxy re-encryption.

And I want to implement this through BLS12-381 Curve. However, When looking at the documentation for paring or the library, the value of $F_{q^{12}}$ is output as the output of pairing.

The paper requires:

Let e : $G_1$ × $G_1$$G_2$ be a bilinear map, z = e($G_1$, $G_1$) ∈ $G_2$

And need to compute (zrG + Pm)

How can I multiply z in $F_{q^{12}}$ and $rG$ Point in $F_{q}$from "$z$ $rG$"?

Should I replace $F_{q^{12}}$ with $F_{q}$? If so, how?

And please let me know what to look for to get relevant knowledge.

  • $\begingroup$ Are you coding this is Javascript? $\endgroup$
    – Titanlord
    Commented Jul 17, 2020 at 13:14
  • $\begingroup$ And yes it is possible to convert from $F_{p^{12}}$ to $F_p$, but it is pretty complex. You need the correct polynom for that. I would suggest you to use a library, that can do the arithmetic in $F_{p^{12}}$. E.g. SageMath can do this. $\endgroup$
    – Titanlord
    Commented Jul 17, 2020 at 13:17
  • $\begingroup$ @Titanlord How do you convert a finite field to another? Finite fields are isomorphic iff the orders are same. $\endgroup$
    – kelalaka
    Commented Jul 17, 2020 at 19:19

1 Answer 1


The paper writes $z^r \cdot G$; however $z^r$ is a member of the extension group $\mathbb{F}_{q^{12}}$, while point multiplication is formally defined over the integers; you ask "what are we supposed to do here?"

Well, going through the paper, it appears that if we rewrite that equation to $h(z^r) \cdot G$, where $h$ is a function from $\mathbb{F}_{q^{12}}$ to $\mathbb{F}_{q}$, that works (assuming, of course, we rewrite the decryption process similarly), so we have:

$\text{Encrypt}(pk, m) = (r \cdot pk, h(z^r) \cdot G + Pm)$

$\text{Decrypt}^1(C, sk) = B - h( e( A, sk^{-1}G )) \cdot G$

$\text{Decrypt}^2(C, sk) = B - h( A^{1/b} ) \cdot G$

(see the paper for explanation of the various notations, and the reencrypt process doesn't change)

Any deterministic $h$ would work (in the sense that the protocol will work), as can be seen by going through encryption/reencryption/decryption steps. My inclination would be to use a hash function.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.