# Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

23 questions
Filter by
Sorted by
Tagged with
2k views

### Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
2k views

### Is pairing based cryptography ready for productive use?

I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps. It's quite hard to understand the underlying fundamentals, especially since there are several ...
2k views

### When do we need composite order groups for bilinear maps and when prime order?

Why we need bilinear groups of composite order? What's the special security property of the composite order group in comparison with one of prime order? To put it in another way when do we need ...
757 views

### Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
8k views

### What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
189 views

### the decryptNode function for leaf nodes in CP-ABE

Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-...
3k views

### How to Mathematically Prove the Bilinear Pairing Properties [closed]

I am currently working on Bilinear Pairing.To start my work i need to find the mathematically prove of three properties of bilinear pairing. Let $G_{1}$ and $G_{T}$be a cyclic multiplicative ...
573 views

### Security of pairing-based cryptography over binary fields regarding new attacks

In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$. Pairing-based cryptography using binary ...
416 views

### Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
970 views

I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let $e: \mathbb G_1 \... 3answers 510 views ### Can you help me understand pairing$e:G \times G \to G_T$and ( Decision) BDH assumption? From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map$e:G \times G \to G_T$. Am I ... 0answers 184 views ### Prime extension field encoding ASN.1 ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields. I'm looking for known ... 2answers 876 views ### What does the linear assumption over bilinear groups mean? In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say: In both schemes we rely on the linear assumption over bilinear groups. What ... 1answer 393 views ### Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification? I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ... 1answer 623 views ### Useful pairings for cryptography I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ... 1answer 513 views ### Sextic twist optimization of BN pairing - cubic root extraction required? I found the following paper really interesting: http://www.researchgate.net/publication/220378229_A_family_of_implementation-friendly_BN_elliptic_curves/file/79e4150b3a773beecd.pdf It allows ... 1answer 437 views ### Why pairing based crypto is suitable for some particular cryptographic primitives? Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ... 3answers 430 views ### How is it decided if$G_1$and$G_2$are two “additive” or “multiplicative” cyclic groups? According to wiki's definition of Bilinear pairing… Let$G_1$and$G_2$be two additive cyclic groups of prime order$q$, and$G_T$another cyclic group of order$q$written multiplicatively. A ... 1answer 206 views ### Generalization of the DL-assumption in bilinear group pair When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let$e \colon G_1, G_2 \to G_T$be a Type 3 pairing. Then: Given$P, zP \in G_1$and$Q, zQ \in G_2$, ... 1answer 548 views ### How to calculate mapping in bilinear I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p$e: G * G \to G_t$. be a map with the ... 1answer 407 views ### Pairings in Identity-based encryption vs. Attribute-based encryption The bilinear map in Identity-based encryption should satisfy$e(aP,bQ)=e(P,Q)^{a\cdot b}$whereas Attribute-based encryption schemes use$e(P^a,Q^a)=e(P,Q)^{a\cdot b}$with$a,b\in\mathbb{Z}_p$and$e:...
I am working on the following exercise: Now, assume the following signature scheme: $\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...