Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

Filter by
Sorted by
Tagged with
1 vote
1 answer
40 views

Why use pairing to construct identity based encryption?

Identity Based Encryption is an asymmetric encryption scheme such that encryption uses the receiver's identity as the public key. Such a identity can be receiver's email address or some other string ...
user avatar
  • 45
0 votes
0 answers
26 views

Multiplicities of poles of a divisor of a rational function w.r.t. an elliptic curve

I am reading Sec 5.8.2 in the textbook Introduction to Mathematical Cryptology (Hoffstein, Pipher and Silverman), a precursor to introducing the structure of Weil pairing. It first defines a rational ...
user avatar
  • 249
0 votes
0 answers
47 views

A doubt in pairing based cryptography

I have seen authors taking $G_1=G_2=G_T=G$ to be the same group of prime order $q$. What I know is that for pairing of type $$e:G_1\times G_2\rightarrow G_T,$$ size of the element in the target group ...
user avatar
0 votes
0 answers
26 views

Two different bilinear mappings in PBC

In pairings-based cryptography, are there any examples of systems where they use two different bilinear mappings. That is, they make use of both $e_1$ and $e_2$ where $e_1$ is a symmetric bilinear ...
user avatar
  • 249
0 votes
0 answers
45 views

'NIZK arguments for quadratic arithmetic programs' of '[Groth16] On the Size of Pairing-based Non-interactive Arguments'

I wonder about the CRS of NIZK argument. I think [A]$_1$, [B]$_2$, [C]$_1$ is calculated using CRS. Instead of calculating A, B, C first and then calculating [A]$_1$, [C]$_1$, [B]$_2$. May I know if ...
user avatar
0 votes
0 answers
23 views

How to get the generator of composite order group in JPBC?

I have read some code, the generator of the additive group of prime order is easy to get because every element in the group is a generator.So in JPBC I just need to randomly generate elements as ...
user avatar
  • 1
2 votes
1 answer
53 views

Why is the set of r-torsion points isomorphic to $\mathbb{Z}_r \times \mathbb{Z}_r$

I'm reading "On the implementation of pairing-based cryptosystems". It states that $E(\mathbb{F}_{k^q})[r]$ is isomorphic to the product of $\mathbb{Z}_r$ with itself. $E(\mathbb{F}_{k^q})[r]...
user avatar
  • 247
1 vote
0 answers
37 views

Norm() of bilinear pairing

Consider two points P, Q over a pairing friendly elliptic curve $E[F_q]$, e.g., BN254. Let Z = e(P, Q). It is known that $Z \in F_{q^k}$ where $k$ is the embedding degree. The norm map N(Z) is defined ...
user avatar
  • 75
2 votes
1 answer
149 views

How to have a hash function that maps any binary string of size n to binary string of size n?

I am implementing certificateless cryptography from this research paper in python language. Essentially, I want to have the following hash function mapping. This hash function is mentioned in the ...
user avatar
  • 43
2 votes
1 answer
251 views

What is a function on a Line or a Curve?

I am reading up on Pairings using Elliptic curves & all the texts talk about functions on a Curve. I am finding it difficult to even figure out what they mean by "function on a curve" or ...
user avatar
  • 1,637
2 votes
1 answer
131 views

Size of group elements in a bilinear context

In a asymetric pairing context, which size (in bits) should have the elements of $\mathbb{G}_1,\mathbb{G}_2$ and $\mathbb{G}_T$ if we consider the most efficient elliptic curves?
user avatar
  • 2,181
2 votes
1 answer
154 views

How to have a hash function that maps from a group element to a binary string of a certain size in charm-crypto?

I am facing a problem in programming with the charm-crypto library. The hash functions for pairing group elements in charm-crypto can only map from a string to a specific field: $\mathbb Z_r$, $G_1$ ...
user avatar
  • 43
1 vote
1 answer
45 views

Developments in ABE using Pairings

What are the recent developments in Attribute-Based Encryption (ABE) using Pairings assumptions? Is pairings the most viable assumption while designing ABE. What other assumptions are used for ABE ...
user avatar
1 vote
0 answers
53 views

Multiplication of pairings vs. exponentiation of the group elements

Assume that we have a pairing as $e:G_1\times G_2\rightarrow G_T$. such that $g_1$ and $g_2$ are the generator of $G_1$ and $G_2$ respectively. In a protocol I have $A=\prod_{i=1}^n e(H(i),pk_i)$ ...
user avatar
  • 315
0 votes
0 answers
33 views

issues understanding some basic points about identity based encryption

I've been trying to understand an article (https://ieeexplore.ieee.org/document/8538446) about using blockchain to overcome identity based encryption (ibe) drawbacks. My purpose is to be able to code ...
user avatar
  • 1
1 vote
0 answers
66 views

What's the difference between Optimal ate pairing and R-ate pairing?

I compare the algorithm description of Optimal ate pairing and R-ate pairing, it turns out to me that the formulas are the same. So I'm a little confused, what's the difference between them? or is it ...
user avatar
5 votes
1 answer
139 views

Pairing-friendly curve whose group order is a safe prime

Are there any pairing-friendly curves whose group order is a safe prime? That is: the order of the group is $2q + 1$ for some prime number $q$. Or, is it impossible to have such groups?
user avatar
  • 75
1 vote
0 answers
20 views

Chaining a smaller group inside the pairing friendly group

Let's say there is a bilinear pairing $G \times G \rightarrow G_t$ (e.g., for bn128), and let prime $q$ be the order of $G$. Is it possible to find a prime order group over integers such that its ...
user avatar
  • 75
1 vote
0 answers
39 views

Can we instantiate VRF without using pairing?

As my survey, most of(I am not sure if it is "all") the constructions of VRF are instantiated with the use of pairing. Can we construct a VRF without using pairing?
user avatar
  • 707
1 vote
0 answers
37 views

Range proofs and Groth-Sahai PPEs

I'm looking for a set of pairing product equations (ala Groth-Sahai) which allow a prover to prove that the output of a VRF is in a specific range. In the E-cash system in [BCKL] there is a ...
user avatar
3 votes
1 answer
273 views

Is this pairing-based signature scheme secure?

There are a number of signature schemes on small domains based on bilinear pairings which do not use random oracles. Examples are the Boneh-Boyen schemes and an interesting one from Okamoto which ...
user avatar
  • 346
3 votes
2 answers
91 views

Independent parameters basis for torsion-groups in SIDH: Is the Weil-pairing necessary?

In the original SIDH paper by De Feo, Jao and Plût, the basis points $P_A$ and $Q_A$ are supposed to be independent points in $E(\mathbb{F}_{p^2})$ of order $\ell_A^{e_A}$ for some small prime $\ell_A$...
user avatar
  • 33
2 votes
1 answer
52 views

Hard Problems in Pairings

I want to know whether the following problem is considered as a hard problem in complexity theory or not? Given $g,g^a,g^b \in G_1$ (for unknown $a,b\in \mathbb{Z}_p^{\ast}$), compute $e(g,g)^{ab^2}\...
user avatar
4 votes
5 answers
4k views

Why do we use groups, rings and fields in cryptography?

I'm a student of Masters in Cyber Security. I have a habit to understand things from their first principles (at the very beginning). Kindly use any simple mathematical example to answer because I have ...
user avatar
  • 57
2 votes
1 answer
87 views

Software implementation of symmetric and asymmetric bilinear pairings

I have recently read a paper about pairings, which only implemented asymmetric bilinear pairings and it mentiond that $\eta_{T}$ pairing is the most efficient algorithm for symmetric pairings. I ...
user avatar
  • 65
0 votes
0 answers
73 views

How to prove possession of a CL signature in zero-knowledge?

Assume that we have the following signature scheme CL Signature: Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$. Uniformly and ...
user avatar
  • 511
2 votes
1 answer
72 views

How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?

In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about ...
user avatar
  • 243
1 vote
1 answer
222 views

Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
user avatar
  • 13
2 votes
1 answer
328 views

Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, ...
user avatar
  • 113
1 vote
1 answer
69 views

Importance of supersingularity of elliptic curves

I'm struggling to understand the high-level idea of "Verifiable Delay Functions from Supersingular Isogenies and Pairings" (https://eprint.iacr.org/2019/166.pdf) by De Feo et al. I will ...
user avatar
2 votes
1 answer
90 views

In q-SDH problem, where are those points $\frac{1}{\beta+x}g_1$ or $g_1^\frac{1}{x+c}$ on elliptic curve?

For the q-SDH problem, given the generator $g_1$ as a point on the elliptic curve, I can picture the $\beta g_1, \beta^2g_1, ..., \beta^qg_1$ since we can simply do the point adding $g_1$ multiple of $...
user avatar
  • 113
3 votes
1 answer
150 views

How to achieve identity authentication without revealing credentials

I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
user avatar
  • 249
0 votes
1 answer
110 views

Exponentiation Problem of G2 in MNT curve

I made a simple python program in the Charm framework (https://github.com/JHUISI/charm): ...
user avatar
  • 21
0 votes
0 answers
34 views

Where can I find references to the theory behind PBC library?

I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
user avatar
  • 167
1 vote
1 answer
93 views

Can I convert $F_{q^{12}}$ to $F_q$?

I seeing a paper about Elliptic curve based proxy re-encryption. And I want to implement this through BLS12-381 Curve. However, When looking at the documentation for paring or the library, the value ...
user avatar
3 votes
1 answer
400 views

What is different between G1×G1→GT and G1×G2→GT in the bilinear pairing?

It is an implementation of the bls12-381 algorithm known as pairing-friendly, at GitHub. Looking at this, the pairing parameters are $G_1$ and $G_2$, $G_1$ is the point of $F_q$, $G_2$ is the point of ...
user avatar
0 votes
0 answers
55 views

How to estimate the computation overhead of ECDSA?

I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005, 9, and 4.4 ms respectively. I want to ...
user avatar
1 vote
0 answers
46 views

Fixed variable in Groth16

In the paper On the Size of Pairing-based Non-interactive Arguments by Jens Groth, it is always referred in the equations to satisfy that $a_0 = 1$ and the others $a_1, ..., a_m \in \mathbb{F}$. I am ...
user avatar
  • 386
0 votes
0 answers
102 views

Can Pedersen commitment be used in pairing groups?

For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
user avatar
3 votes
1 answer
193 views

Current situation of bilinear pairing protocols

The bilinear pairings are considered as the key enabler for many novel cryptographic protocols, such as three-party one round DH[1], shorter signatures and certificateless (ID-based) crypto[3] , which ...
user avatar
  • 225
4 votes
1 answer
149 views

Understanding the groups used in bilinear Ate-pairing

The bilinear ate pairing $e:G_1\times G_2 \rightarrow G_T$ is defined over the following groups: \begin{equation} \begin{aligned} & G_1 = E(\mathbb{F}_p)[r] \cap Ker(\pi_p-[1]), \\ & G_2 = E(...
user avatar
  • 225
2 votes
0 answers
73 views

Groth-Sahai Proof of multi-exponentiation

I want to create a NIZK proof of a multi-exponentiation via Groth-Sahai proofs. In the lectures of Jens Groth in a winter school of Bar-Ilan University, he shows a way to transform multi-...
user avatar
1 vote
0 answers
27 views

Is the k-sum attack efficient in bilinear pairing variants?

From the k-sum definition, the objective is to solve something like: $\sum_{i=1}^n c_i = v_1$ where $v_1$ is known. If we use Elliptic Curve Points ($C_i$ and $G$) we can define a bilinear pairing ...
user avatar
  • 398
2 votes
1 answer
182 views

Bilinear Map over group of unknown order

Is it possible to build a bilinear map where the underlying group is of unknown order? To maintain context, the original question appears below. As per poncho's excellent answer, my original idea is ...
user avatar
4 votes
1 answer
126 views

What are the BLS12-381 settings?

I can't find the exact type and settings for the BLS12-381 curve. Is this type-3 in Symmetric XDH settings ?
user avatar
  • 398
0 votes
1 answer
141 views

Can BLS aggregate signatures be merged?

In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures? For example, say you have two aggregate signatures, $...
user avatar
  • 113
1 vote
0 answers
38 views

Pair-friendly elliptic curves vs non friendly

Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
user avatar
  • 515
5 votes
0 answers
82 views

Are all MNT curves assumed to hold XDH?

For one of my projects, I need a pairing group which holds the External co-Diffie-Hellman assumption. I am trying to implement it using Charm crypto python modules which provides support for MNT ...
user avatar
2 votes
1 answer
138 views

Variants of Bilinear Diffie-Hellman Assumption

Could someone point me to the paper/reference where the following variant of q-strong Bilinear Diffie-Hellman assumption was used? Given $s \in \mathbb{Z}_p^*$ and $g, g^{\frac{1}{s}}, g^{s}, g^{s^2},...
user avatar
  • 153
1 vote
0 answers
37 views

What to learn in order to understand Weil Divisors

My current role as a software developer is leading into areas of research in elliptic-curve-cryptography that keeps bringing me back to bilinear pairings. This includes BLS Signatures, CL Signatures ...
user avatar
  • 223

1
2 3 4 5