Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

275 questions
Filter by
Sorted by
Tagged with
1 vote
45 views

Has the ideal "pairing" $\langle aG, bG\rangle \mapsto abG$ been ruled out conditionally?

Let $G$ be a prime order $Q$ elliptic curve over a prime field of size $P$ which admits the following mapping $f$ $f(aG, bG) = abG$ which can be computed in polynomial time in $\log(PQ)$. Is the ...
• 195
32 views

In groth16, how restricting public Inputs to the prime field instead of the snark scalar field can be used?

Recently such an overflow was fixed in snarkjs but given the small difference between the 2 and that it was restricted to the prime field anyway, how could this be exploited ?
• 240
79 views

Not able to find any references for opening of BBS+ signature

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts ...
1 vote
45 views

Unable to find any references for opening of BBS+ signature [duplicate]

I've reviewed the BBS signature scheme and the constant size k-TAA, known as BBS+. However, I couldn't find any specific mechanism for opening in BBS+. In the constant size k-TAA, if a user attempts ...
66 views

Bilinear pairing question

Can I calculate below equation? $e(g_1^{a}, g_2^{b}) / e(g_1^{a}, g_2^{b+c}) / e(g_1^{a}, g_2^{c}) = 1$ '/' means divide. I think it works, but there is no evidence to prove it.
• 1
37 views

Can I compute the following bilinear pairing equation?

Given $G_1 \times G_2 \mapsto G_t$, How can I compute the following equations? Firstly, $e(g_1^a, g_2^b) = g_t^{ab}$ After that, $(e(g_1^a, g_2^b))^{c} = g_t^{abc}$
529 views

1 vote
99 views

Where & how is the 2nd group used in the KZG Commitment Scheme in case the 2 groups are not the same?

This is about the KZG Polynomial Commitment Scheme In Section 2, it's written We use the notation $e : \mathbb G \times \mathbb G \mapsto \mathbb G_T$ to denote a symmetric (type 1) bilinear pairing....
• 2,262
36 views

What is a efficient algorithm to compute e(u, v) in bilinear map

My problem is about this paper Efficient k-out-of-n oblivious transfer scheme with the ideal communication cost https://www.sciencedirect.com/science/article/pii/S0304397517309143 I don't know what is ...
1 vote
88 views

How many pairings are needed to verify beta term in GGPR13 zk-snark? Pinocchio paper says 3 but I count 4

The Pinocchio paper contains a description of the GGPR protocol (Protocol 1), and states that verification requires "8 pairings for the $\alpha$ terms, and 3 for the $\beta$ term". However I ...
• 121
54 views

Is bilinear pairing reversible?

Given $e(a,b)$ as known, can I get the value of $a$ or $b$?
• 21
1 vote
54 views

Any SuperSingular curve or similar with Fp = Fq which is not badly broken unless big field orders are used?

AFAIK, SuperSingular curves appear to be broken by MOV: A. J. Menezes, T. Okamoto and S. A. Vanstone, "Reducing elliptic curve logarithms to logarithms in a finite field," in IEEE ...
• 325
144 views

How to find second subgroup for ECC Pairing?

Pretty new to ECC Pairings. I am trying to understand KZG Commitments from multiple sources. I found this blog beginner friendly and easier to understand. However, I'm stuck at ECC Pairings and having ...
164 views

Division of two Elliptic curve points in KZG polynomial commitment scheme!

I have some issue to understand the verify round of the KZG polynomial commitment scheme. The following diagram is associated to the scheme. I appreciate any help. To verify, the verifier should ...
• 181
1 vote
121 views

Proving scalar multiplication given elliptic curve points

From this blog post: https://medium.com/@VitalikButerin/exploring-elliptic-curve-pairings-c73c1864e627 if P = G * p, Q = G * q and R = G * r, you can check whether or not p * q = r, having just P, Q ...
• 33
104 views

Why not compose bilinear maps for higher arity maps?

I understand the only multilinear maps used in cryptography are bilinear maps, and higher arity multilinear maps are not "known." Why does the composition of bilinear maps not yield usable ...
586 views

Is pairing-based crypto post-quantum secure?

Bilinear Pairings are widely used in many new schemes like Group Signature and Aggregate Signature. The problem is whether it is post-quantum secure. In other words, does Bilinear Diffie-Hellman ...
77 views

• 121
119 views

Why pairing domains are subgroups of the r-torsion group?

In pairing based cryptography (PBC) we restrict the pairing domains to be subgroups of the $r$-torsion group $E[r]$. This arises two questions to me: Why do we restrict them to subgroups of $E[r]$? ...
• 762
144 views

Bilinear pairing for compact BLS signature

What family of bilinear pairing is recommendable for BLS signature when the overriding criteria is compactness of the signature, as desirable for something to be keyed-in from printout, or embedded in ...
• 144k
119 views

Importance of non-degeneracy property of bilinear map for cryptography

I'm currently looking into pairing-based cryptography and I stumbled upon the definition of the properties bilinearity, computability and non-degeneracy. Now I have a problem with understanding the ...
1 vote
242 views

What is a practical application of evaluating at a point in the Kate Polynomial Commitment Scheme?

I understand how the Kate Polynomial Commitment Scheme Evaluation Proof works however, I don't understand what is the purpose of it? In general, in a commitment scheme, Peggy commits to message & ...
• 2,262
113 views

• 247
1 vote
46 views

Norm() of bilinear pairing

Consider two points P, Q over a pairing friendly elliptic curve $E[F_q]$, e.g., BN254. Let Z = e(P, Q). It is known that $Z \in F_{q^k}$ where $k$ is the embedding degree. The norm map N(Z) is defined ...
• 109