Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

1
vote
0answers
41 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
2
votes
0answers
31 views

Where to find parameters for particular supersingular curve

In the PBC (Pairing Based Crypto) library, the curve parameters of the type A pairings are constructed on the curve $y = x^3 + x$ of embedding degree $2$. I implemented a code for curves $y^2 = x^3 + ...
0
votes
0answers
53 views

Hint for needed hardness assumption

Suppose we have a type-3 pairing $(q,\mathbb{G_1},\mathbb{G_2},\mathbb{G_T},g_1,g_2,e)$, that holds $SXDH$ assumption. Given $(g_1,g_1^a,g_1^b,g_1^c,g_1^m,g_1^{m'},g_1^{a\cdot m}, g_1^{b\cdot m'},...
0
votes
0answers
46 views

Understanding creation of distortion map

I'm trying to implement a distortion map but I have a problem. I know the basics and I read some questions like this one and asked some questions here. If I have an elliptic curve $E : y^2 = x^3 + 1$ ...
3
votes
1answer
115 views

How to find a primitive cube root of unity

I would like some help to understand how to compute a distortion map and the result of a pairing. I know that with this equation : $E : y^2 = x^3 + 1$ over some $\mathbb{F}_p$ we have a distortion ...
6
votes
0answers
78 views

Proving multiple products “in the exponent”

I'm trying to come up with a small-sized (non-interactive) proof for a Diffie-Hellman-like statement. I'll start by giving an example. The prover has $g^a, g^b, g^c, g^{ac}, g^{ab}, g^{bc}, g^{abc}$. ...
0
votes
0answers
45 views

Pairing in implementation of a simple digital signature

I'm trying to implement in python the 1st scheme from the paper "Efficient Identity Based Signature Schemes Based on Pairings" by Hess to learn elliptic curve cryptography. It's a simple digital ...
0
votes
0answers
52 views

Is it safe to use Barreto-Naehrig curve 158 bit?

I'm trying to understand the Pairing-Friendly Elliptic Curves of Prime Order and I need to know if it is acceptable to use the BN-158 curves, hence if this curve ensures a security level of 80 bits. I'...
3
votes
1answer
126 views

Why “pairings on elliptic curve” are used?

I'm just curious why do we use pairings on elliptic curve cryptography. There is a lot of information about how to use it, but I cannot find information about why to use it. Can somebody help?
0
votes
0answers
13 views

Why would multiple messages need to be signed in an anonymous credential system?

I'm reading through Signature Schemes and Anonymous Credentials from Bilinear Maps, and the signature scheme that they build up to involves a signature on a tuple of messages $(m_1,m_2,...,m_n)$. Can ...
0
votes
1answer
63 views

Understanding the big picture with regard to how anonymous credentials work

I'm trying to learn about anonymous credential systems. I started with Lysyanskaya's thesis, which gives an outline of how to build an AC system given some particular primitives (signature scheme, ...
1
vote
1answer
89 views

Weil pairing of P and Q

it the following example for page 56 of the book http://www.craigcostello.com.au/pairings/PairingsForBeginners.pdf I could not understand how the author found the Weil pairing of two points p and Q. I ...
1
vote
2answers
107 views

DDH and pairings are not contradictory in RingCT 2.0?

As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0. How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
1
vote
0answers
37 views

Complexity lower bound in Uber-Assumption family

I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen (http://www.academia.edu/download/30698012/...
1
vote
1answer
96 views

co-DHP* in G2 for type 3 pairing

In type 3 pairing ($e:G_1 \times G_2\rightarrow G_\tau$ where $G_1\ne G_2$ and no isomorphism from $G_2$ to $G_1$ is known) we have co-DHP* problem: Given $H, aP \in G_1$ and $aQ\in G_2$ calculate $...
-1
votes
1answer
134 views

Pairing in Cryptography [closed]

I am having problems in doing pairing in cryptography. I have tried the PBC library but seems like it doesn't work and I do not understand the documentation because it uses C++ language. Is there a ...
1
vote
0answers
157 views

Functional signatures with ECDSA Verifier

Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
3
votes
0answers
70 views

Pairings over elliptic curves on rings

Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings ...
1
vote
1answer
274 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ...
0
votes
0answers
28 views

Can I reuse e(P1,P2) of Sakai-Kasahara setup?

In the Sakai-Kasahara setup, we need to calculate the $g = e(P_1,P_2)$ pairing. Is it safe to calculate multiple Master Secrets using the same value for $g$ (across different instances)? Or do I need ...
1
vote
0answers
36 views

Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?

Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
1answer
78 views

Linkable Ring Signatures on Pairing-Friendly curves

I'm working on a pairing-friendly (Barreto-Naehrig) elliptic curve. If I understand correctly, one consequence of this is that the Decisional Diffie-Hellman assumption no longer holds, but the ...
2
votes
0answers
153 views

What pairings are used in PBC and charm-crypto with the proposed elliptic curves?

I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
4
votes
1answer
64 views

Question about the location of the r-torsion in the quotient group used in the Tate pairing

I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the Tate pairing. He defines $rE = \{r*P | P \in E(\mathbb{F}_{q^k})\}$ and then forms the quotient group $E(\...
2
votes
1answer
78 views

Usage of twists at pairing-based cryptography

First of all I would like to understand how twists are used in pairings. The 2nd step is, how to use them to improve the calculation speed? Say $E'(\mathbb F_{p^2})$ is a twist of $E(\mathbb F_p)$. ...
1
vote
1answer
261 views

Usage of pairings in proxy re-encryption algorithm

I am having trouble understanding one part of the AFGH algorithm for proxy re-encryption (my background in discrete mathematics is lacking a bit). The paper describes the algorithm setup the ...
1
vote
0answers
64 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
3
votes
1answer
178 views

Can Curve25519 be used for pairing-based cryptography?

We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more ...
2
votes
0answers
101 views

Frey-Rück Attack (FR-Reduction) - Tate Pairing

I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
4
votes
1answer
156 views

Does the following Diffie-Hellman problem hold in bilinear groups $G\times G \rightarrow G_T$

For every PPT distinguisher A there exists a negligible function $neg(·)$ such that for all $\lambda$ $|\Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^{ab}) = 1] - \Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^z) = 1]| \...
1
vote
1answer
167 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
2
votes
0answers
141 views

Prime extension field encoding ASN.1

ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields. I'm looking for known ...
6
votes
1answer
275 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
9
votes
1answer
147 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
4
votes
1answer
198 views

Pairing on FourQ

How would you define a pairing on the - so called - curve "Four$\mathbb Q$? Since FourQ is a twisted Edwards curve, given by $E/\mathbb F_{q}:\ -x^2+y^2 = 1+dx^2y^2$, where $d\in\mathbb F_p(i), q=p^2,...
4
votes
2answers
157 views

Special-purpose witness encryption without multilinear maps

In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they ...
1
vote
1answer
120 views

Is it safe to use pairing-based cryptography in a commercial product?

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a ...
0
votes
0answers
122 views

What are the known attacks on the BLS(Boneh–Lynn–Shacham) signature scheme?

Are there even any existing side channel attacks like fault attacks on the BLS signature scheme?
4
votes
1answer
68 views

Does pairings based cryptography inherently require a CRS/trusted setup?

In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always ...
4
votes
1answer
253 views

Frobenius Map on BN Curve sextic twist?

I'm new to cryptography and I am working on R-ate Pairings on a BN Curve: $y^2=x^3+b$ with $b$=5 with its M-type twist: $y^2=x^3+b\beta$, and $\beta^2 = -2$. The base finite field characteristic ...
0
votes
0answers
48 views

Non-trivial access structures

I am currently working with this paper about a searchable encryption scheme where access to search operations is restricted via monotone access structures and sets of attributes. In the definition of ...
4
votes
1answer
431 views

BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
0
votes
1answer
130 views

How can I plot graphs of CP-ABE scheme using charm crypto?

Can I use charm crypto tool to run it over my datasets for CPABE scheme and plot graphs using its Benchmarking tool ? Or, how can I use Charm Crypto tool with CPABE toolkit ?
0
votes
0answers
38 views

How to implement Full domain Hash Function [duplicate]

I am making a project using bilinear maps (ORUTA). It uses full domain hash function and is given by: $$H : \{0, 1\}^* \rightarrow \mathbb G_1 $$ Where $\mathbb G_1$ is a multiplicative cyclic group. ...
4
votes
1answer
99 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
3
votes
0answers
62 views

How to construct a hash function that maps any binary string into a multiplicative group element? [duplicate]

Pairing based cryptography schemes such as identity-based encryption or different attribute-based encryption schemes (CP-ABE, KP-ABE etc.) often make use of a hash function defined as $H_1:\{0,1\}^* \...
1
vote
1answer
648 views

Decisional Diffie-Hellman assumption vs decisional bilinear Diffie-Hellman assumption

For the Decisional Diffie-Hellman (DDH) assumption we know that: Given $g^a$ and $g^b$ for uniformly and independently chosen $a,b \in Z_p$ the value of $g^{ab}$ looks like a random value in group $\...
0
votes
2answers
132 views

Pairing - Is it possible to map two $r$-torsion points to a $r^2$-torsion point?

Let $E(\mathbb F_{q^k})$ be an elliptic curve on finite field $\mathbb F_{q^k}$, where $\mathbb F_{q^k}$ is an extension of $\mathbb F_q$ with $k>1$. Let $e: G_1 \times G_2 \rightarrow G_t$ be a ...
0
votes
1answer
83 views

Order of target group in pairing

Let $N=pq$, where $p$ and $q$ are prime numbers, and order of $G_1$ and $G_2$ is equal to $p$. Suppose that $e(G_1, G_2)=G_t$ is a pairing of composite order. I know that, usually the order of target ...
4
votes
1answer
150 views

Order of target group in bilinear pairing

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers. Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ ...