Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

0
votes
0answers
32 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
3
votes
1answer
71 views

Order of twisted curve in pairings

We are doing optimal Ate pairings using a Barreto-Naehrig curve, and I am trying to make sure that an observation I made generalizes. We define $E$ as $y^2 = x^3 + 3$ and use the tower of extensions \...
1
vote
1answer
53 views

Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption,...
1
vote
0answers
60 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
13 views

The multi-linear maps are prone to zeroizing attack. Can anyone explain how the zeroizing attack breaks the computational assumptions?

I read that many cryptographic schemes based on multi-linear mapping are not secure because the zero testing procedure and zero encoding help an adversary to reveal the secrets and because of it, many ...
4
votes
1answer
188 views

Simple explanation of Miller's algorithm

Could someone explain to me in few lines (even one sentence) what Miller's algorithm computes? Without talking about divisors and all the other concepts, I would like to be able to explain it to ...
1
vote
0answers
50 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
2
votes
0answers
37 views

Where to find parameters for particular supersingular curve

In the PBC (Pairing Based Crypto) library, the curve parameters of the type A pairings are constructed on the curve $y = x^3 + x$ of embedding degree $2$. I implemented a code for curves $y^2 = x^3 + ...
0
votes
0answers
63 views

Understanding creation of distortion map

I'm trying to implement a distortion map but I have a problem. I know the basics and I read some questions like this one and asked some questions here. If I have an elliptic curve $E : y^2 = x^3 + 1$ ...
3
votes
1answer
134 views

How to find a primitive cube root of unity

I would like some help to understand how to compute a distortion map and the result of a pairing. I know that with this equation : $E : y^2 = x^3 + 1$ over some $\mathbb{F}_p$ we have a distortion ...
9
votes
0answers
106 views

Proving multiple products “in the exponent”

I'm trying to come up with a small-sized (non-interactive) proof for a Diffie-Hellman-like statement. I'll start by giving an example. The prover has $g^a, g^b, g^c, g^{ac}, g^{ab}, g^{bc}, g^{abc}$. ...
0
votes
0answers
78 views

Pairing in implementation of a simple digital signature

I'm trying to implement in python the 1st scheme from the paper "Efficient Identity Based Signature Schemes Based on Pairings" by Hess to learn elliptic curve cryptography. It's a simple digital ...
0
votes
0answers
71 views

Is it safe to use Barreto-Naehrig curve 158 bit?

I'm trying to understand the Pairing-Friendly Elliptic Curves of Prime Order and I need to know if it is acceptable to use the BN-158 curves, hence if this curve ensures a security level of 80 bits. I'...
3
votes
1answer
164 views

Why “pairings on elliptic curve” are used?

I'm just curious why do we use pairings on elliptic curve cryptography. There is a lot of information about how to use it, but I cannot find information about why to use it. Can somebody help?
0
votes
0answers
13 views

Why would multiple messages need to be signed in an anonymous credential system?

I'm reading through Signature Schemes and Anonymous Credentials from Bilinear Maps, and the signature scheme that they build up to involves a signature on a tuple of messages $(m_1,m_2,...,m_n)$. Can ...
0
votes
1answer
91 views

Understanding the big picture with regard to how anonymous credentials work

I'm trying to learn about anonymous credential systems. I started with Lysyanskaya's thesis, which gives an outline of how to build an AC system given some particular primitives (signature scheme, ...
1
vote
1answer
155 views

Weil pairing of P and Q

it the following example for page 56 of the book http://www.craigcostello.com.au/pairings/PairingsForBeginners.pdf I could not understand how the author found the Weil pairing of two points p and Q. I ...
1
vote
2answers
147 views

DDH and pairings are not contradictory in RingCT 2.0?

As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0. How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
1
vote
0answers
41 views

Complexity lower bound in Uber-Assumption family

I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen (http://www.academia.edu/download/30698012/...
1
vote
1answer
104 views

co-DHP* in G2 for type 3 pairing

In type 3 pairing ($e:G_1 \times G_2\rightarrow G_\tau$ where $G_1\ne G_2$ and no isomorphism from $G_2$ to $G_1$ is known) we have co-DHP* problem: Given $H, aP \in G_1$ and $aQ\in G_2$ calculate $...
-1
votes
1answer
227 views

Pairing in Cryptography [closed]

I am having problems in doing pairing in cryptography. I have tried the PBC library but seems like it doesn't work and I do not understand the documentation because it uses C++ language. Is there a ...
1
vote
0answers
238 views

Functional signatures with ECDSA Verifier

Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
3
votes
0answers
75 views

Pairings over elliptic curves on rings

Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings ...
1
vote
1answer
341 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ...
1
vote
0answers
36 views

Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?

Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
1answer
91 views

Linkable Ring Signatures on Pairing-Friendly curves

I'm working on a pairing-friendly (Barreto-Naehrig) elliptic curve. If I understand correctly, one consequence of this is that the Decisional Diffie-Hellman assumption no longer holds, but the ...
2
votes
0answers
182 views

What pairings are used in PBC and charm-crypto with the proposed elliptic curves?

I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
3
votes
1answer
69 views

Question about the location of the r-torsion in the quotient group used in the Tate pairing

I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the Tate pairing. He defines $rE = \{r*P | P \in E(\mathbb{F}_{q^k})\}$ and then forms the quotient group $E(\...
2
votes
1answer
81 views

Usage of twists at pairing-based cryptography

First of all I would like to understand how twists are used in pairings. The 2nd step is, how to use them to improve the calculation speed? Say $E'(\mathbb F_{p^2})$ is a twist of $E(\mathbb F_p)$. ...
1
vote
1answer
301 views

Usage of pairings in proxy re-encryption algorithm

I am having trouble understanding one part of the AFGH algorithm for proxy re-encryption (my background in discrete mathematics is lacking a bit). The paper describes the algorithm setup the ...
1
vote
0answers
77 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
3
votes
1answer
223 views

Can Curve25519 be used for pairing-based cryptography?

We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more ...
2
votes
0answers
118 views

Frey-Rück Attack (FR-Reduction) - Tate Pairing

I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
4
votes
1answer
163 views

Does the following Diffie-Hellman problem hold in bilinear groups $G\times G \rightarrow G_T$

For every PPT distinguisher A there exists a negligible function $neg(·)$ such that for all $\lambda$ $|\Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^{ab}) = 1] - \Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^z) = 1]| \...
1
vote
1answer
197 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
3
votes
0answers
161 views

Prime extension field encoding ASN.1

ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields. I'm looking for known ...
6
votes
1answer
351 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
9
votes
1answer
167 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
4
votes
1answer
243 views

Pairing on FourQ

How would you define a pairing on the - so called - curve "Four$\mathbb Q$? Since FourQ is a twisted Edwards curve, given by $E/\mathbb F_{q}:\ -x^2+y^2 = 1+dx^2y^2$, where $d\in\mathbb F_p(i), q=p^2,...
4
votes
2answers
173 views

Special-purpose witness encryption without multilinear maps

In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they ...
1
vote
1answer
140 views

Is it safe to use pairing-based cryptography in a commercial product?

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a ...
0
votes
0answers
147 views

What are the known attacks on the BLS(Boneh–Lynn–Shacham) signature scheme?

Are there even any existing side channel attacks like fault attacks on the BLS signature scheme?
4
votes
1answer
71 views

Does pairings based cryptography inherently require a CRS/trusted setup?

In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always ...
4
votes
1answer
267 views

Frobenius Map on BN Curve sextic twist?

I'm new to cryptography and I am working on R-ate Pairings on a BN Curve: $y^2=x^3+b$ with $b$=5 with its M-type twist: $y^2=x^3+b\beta$, and $\beta^2 = -2$. The base finite field characteristic ...
0
votes
0answers
57 views

Non-trivial access structures

I am currently working with this paper about a searchable encryption scheme where access to search operations is restricted via monotone access structures and sets of attributes. In the definition of ...
4
votes
1answer
554 views

BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
0
votes
1answer
149 views

How can I plot graphs of CP-ABE scheme using charm crypto?

Can I use charm crypto tool to run it over my datasets for CPABE scheme and plot graphs using its Benchmarking tool ? Or, how can I use Charm Crypto tool with CPABE toolkit ?
0
votes
0answers
42 views

How to implement Full domain Hash Function [duplicate]

I am making a project using bilinear maps (ORUTA). It uses full domain hash function and is given by: $$H : \{0, 1\}^* \rightarrow \mathbb G_1 $$ Where $\mathbb G_1$ is a multiplicative cyclic group. ...
4
votes
1answer
104 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
3
votes
0answers
63 views

How to construct a hash function that maps any binary string into a multiplicative group element? [duplicate]

Pairing based cryptography schemes such as identity-based encryption or different attribute-based encryption schemes (CP-ABE, KP-ABE etc.) often make use of a hash function defined as $H_1:\{0,1\}^* \...