As of May 31, 2023, we have updated our Code of Conduct.

# Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

254 questions
Filter by
Sorted by
Tagged with
69 views

### How to find second subgroup for ECC Pairing?

Pretty new to ECC Pairings. I am trying to understand KZG Commitments from multiple sources. I found this blog beginner friendly and easier to understand. However, I'm stuck at ECC Pairings and having ...
19 views

### How can we construct a ZKPoK which hides both $x$ and the witness $W_x$ in dynamic accumulators?

Consider a verification equation $e(\Delta,\tilde{G}) = e(W_x,x\tilde{G}+pk_{acc})$ from a pairing based accumulator which uses the value $x$ and the corresponding witness $W_x$ to verify that a ...
97 views

### Division of two Elliptic curve points in KZG polynomial commitment scheme!

I have some issue to understand the verify round of the KZG polynomial commitment scheme. The following diagram is associated to the scheme. I appreciate any help. To verify, the verifier should ...
1 vote
50 views

### Proving scalar multiplication given elliptic curve points

From this blog post: https://medium.com/@VitalikButerin/exploring-elliptic-curve-pairings-c73c1864e627 if P = G * p, Q = G * q and R = G * r, you can check whether or not p * q = r, having just P, Q ...
82 views

### Why not compose bilinear maps for higher arity maps?

I understand the only multilinear maps used in cryptography are bilinear maps, and higher arity multilinear maps are not "known." Why does the composition of bilinear maps not yield usable ...
304 views

### Is pairing-based crypto post-quantum secure?

Bilinear Pairings are widely used in many new schemes like Group Signature and Aggregate Signature. The problem is whether it is post-quantum secure. In other words, does Bilinear Diffie-Hellman ...
31 views

82 views

### Why pairing domains are subgroups of the r-torsion group?

In pairing based cryptography (PBC) we restrict the pairing domains to be subgroups of the $r$-torsion group $E[r]$. This arises two questions to me: Why do we restrict them to subgroups of $E[r]$? ...
35 views

460 views

### How the mimc bug from circomlib was safely exploited in practice?

Several years ago, there was an unenforced constraint on verification in the cirmcomlib library : a tool for building projects using ZsNarks. The error allowed to forge cryptographic nullifiers/proofs ...
140 views

### Trying to understand the 2nd subgroup in the Weil Pairing used for the MOV attack

EDIT: The bounty is actually to draw more attention. I accidentally chose the wrong reason. $E$ – Elliptic Curve over finite field $\mathbb F_p$. Let $k$ be the embedding degree of the Curve with ...
438 views

### What are the structural differences between BLS12-381 and BLS12-377?

What's the difference between BLS12-381 and BLS12-377? Previously I thought their basic cryptographic algorithms were same, so it's easy to construct BLS12-381 from BLS12-377, or construct BLS12-377 ...
1 vote
81 views

### Is it possible to show and hide certain values of a message and still able to very a BLS aggregated signature?

When using BLS, let's say Alice signs each of the 5 messages ($m_1, m_2, m_3, m_4, m_5$), aggregates the signatures and sends the aggregated signature to Bob. Bob can verify it. Here's the goal: ...
170 views

### Will a semi-hyperelliptic pairing be used in real-world cryptography if it is faster than state-of-the-art elliptic pairings?

Let $\mathbb{G}_1$, $\mathbb{G}_2$, $\mathbb{G}_T$ stand for three groups of the same large prime order $r$. I invented a pairing $e\!: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$ (with ...
1 vote
379 views

### Why the definition of bilinearity property is different in cryptography compared to mathematics?

Background: In Wikipedia (bilinear map definition), a condition listed as the following: For any $\lambda \in F, B(\lambda v,w)=B(v,\lambda w)=\lambda B(v,w)$ In a ...
79 views

85 views

5k views

### Why do we use groups, rings and fields in cryptography?

I'm a student of Masters in Cyber Security. I have a habit to understand things from their first principles (at the very beginning). Kindly use any simple mathematical example to answer because I have ...
118 views

### Software implementation of symmetric and asymmetric bilinear pairings

I have recently read a paper about pairings, which only implemented asymmetric bilinear pairings and it mentiond that $\eta_{T}$ pairing is the most efficient algorithm for symmetric pairings. I ...
129 views

### How to prove possession of a CL signature in zero-knowledge?

Assume that we have the following signature scheme CL Signature: Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$. Uniformly and ...
111 views

### How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?

In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about ...
1 vote
362 views

### Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
392 views

### Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, ...
1 vote
### In q-SDH problem, where are those points $\frac{1}{\beta+x}g_1$ or $g_1^\frac{1}{x+c}$ on elliptic curve?
For the q-SDH problem, given the generator $g_1$ as a point on the elliptic curve, I can picture the $\beta g_1, \beta^2g_1, ..., \beta^qg_1$ since we can simply do the point adding $g_1$ multiple of \$...