Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

Filter by
Sorted by
Tagged with
2
votes
0answers
159 views

Frey-Rück Attack (FR-Reduction) - Tate Pairing

I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
3
votes
1answer
192 views

Does the following Diffie-Hellman problem hold in bilinear groups $G\times G \rightarrow G_T$

For every PPT distinguisher A there exists a negligible function $neg(·)$ such that for all $\lambda$ $|\Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^{ab}) = 1] - \Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^z) = 1]| \...
1
vote
1answer
287 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
3
votes
0answers
183 views

Prime extension field encoding ASN.1

ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields. I'm looking for known ...
6
votes
1answer
469 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
9
votes
1answer
191 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
4
votes
1answer
338 views

Pairing on FourQ

How would you define a pairing on the - so called - curve "Four$\mathbb Q$? Since FourQ is a twisted Edwards curve, given by $E/\mathbb F_{q}:\ -x^2+y^2 = 1+dx^2y^2$, where $d\in\mathbb F_p(i), q=p^2,...
4
votes
2answers
192 views

Special-purpose witness encryption without multilinear maps

In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they ...
1
vote
1answer
157 views

Is it safe to use pairing-based cryptography in a commercial product?

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a ...
3
votes
1answer
81 views

Does pairings based cryptography inherently require a CRS/trusted setup?

In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always ...
4
votes
1answer
292 views

Frobenius Map on BN Curve sextic twist?

I'm new to cryptography and I am working on R-ate Pairings on a BN Curve: $y^2=x^3+b$ with $b$=5 with its M-type twist: $y^2=x^3+b\beta$, and $\beta^2 = -2$. The base finite field characteristic ...
5
votes
1answer
727 views

BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
0
votes
1answer
196 views

How can I plot graphs of CP-ABE scheme using charm crypto?

Can I use charm crypto tool to run it over my datasets for CPABE scheme and plot graphs using its Benchmarking tool ? Or, how can I use Charm Crypto tool with CPABE toolkit ?
3
votes
1answer
105 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
2
votes
0answers
72 views

How to construct a hash function that maps any binary string into a multiplicative group element? [duplicate]

Pairing based cryptography schemes such as identity-based encryption or different attribute-based encryption schemes (CP-ABE, KP-ABE etc.) often make use of a hash function defined as $H_1:\{0,1\}^* \...
2
votes
2answers
948 views

Decisional Diffie-Hellman assumption vs decisional bilinear Diffie-Hellman assumption

For the Decisional Diffie-Hellman (DDH) assumption we know that: Given $g^a$ and $g^b$ for uniformly and independently chosen $a,b \in Z_p$ the value of $g^{ab}$ looks like a random value in group $\...
0
votes
2answers
164 views

Pairing - Is it possible to map two $r$-torsion points to a $r^2$-torsion point?

Let $E(\mathbb F_{q^k})$ be an elliptic curve on finite field $\mathbb F_{q^k}$, where $\mathbb F_{q^k}$ is an extension of $\mathbb F_q$ with $k>1$. Let $e: G_1 \times G_2 \rightarrow G_t$ be a ...
0
votes
1answer
92 views

Order of target group in pairing

Let $N=pq$, where $p$ and $q$ are prime numbers, and order of $G_1$ and $G_2$ is equal to $p$. Suppose that $e(G_1, G_2)=G_t$ is a pairing of composite order. I know that, usually the order of target ...
3
votes
1answer
192 views

Order of target group in bilinear pairing

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers. Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ ...
3
votes
0answers
219 views

TypeA pairing, elliptic curves in pairing based cryptography

I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given. type a ...
1
vote
0answers
51 views

size of group points and parameters in pairing based cryptography

$$e:G_1\times G_1\rightarrow G_2$$ In symmetric pairing-based cryptography with groups$(G_1,G_2)$ of prime order $q$ and $a,b \in Z_q$Will the size of random generator $P$ from$ G_1$ and $a$ be same?...
0
votes
1answer
202 views

Multiplication vs exponentiation in pairing based cryptography

$$P\in G_1$$$$Q\in G_1$$ $$a,b \in Z_q$$ $G_1$ isadditive cyclic group of prime order $q$ $$e(P^{a+b},Q)------(1)$$ $$e(aP+bP,Q)----(2)$$ (1) and (2) will give the same pairing result ...
2
votes
0answers
240 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
1
vote
1answer
81 views

Can I use computational diffie hellman problem in the following scheme?

Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$ $X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public. $m,n,r$ are randomly chosen from $Z_q$. Anybody who knows $(1/r)$ can ...
-1
votes
2answers
95 views

Table of Curve Paramters

I'm studying Elliptic Cruve Cryptograhpy. When I do a search on Google of ECC, I find some pdf where I see these curve's paramters: $q, h, r, exp1, exp2$. What are these parameters ? Are there tables (...
3
votes
3answers
421 views

How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?

According to wiki's definition of Bilinear pairing… Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A ...
2
votes
2answers
279 views

Choice of bilinear group for implementation of BLS signature with NIWI proof?

I am trying to sign the multiple (millions of) different readings but the receiver should not be able to link multiple signed readings together (unlinkability) or with the identity of the signer (...
2
votes
0answers
49 views

How to use maps in the Boneh Gentry Waters encryption scheme?

I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their ...
1
vote
1answer
158 views

Do I need to prove this?

I am using ABE scheme that has already proven under BDHE assumption. Here is the scheme https://eprint.iacr.org/2008/290.pdf In the key generation algorithm, I want to tie the user secret key ...
1
vote
1answer
89 views

Given $ g^s, g^y , g^r, g^t, g^{st-rs}, g^{(yr+d)/t}$ , is it hard to distinguish $e(g,g)^{syr}$ from a random value?

Where $g$ is a group element in bilinear group $G$, $e(g,g)∈GT$ and $s, y, r, t, d$ are randomly chosen. I understand it is very similar to the conventional DBDH problem, but $g^t, g^{st-rs}, g^{(yr+...
5
votes
1answer
152 views

Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference?
0
votes
0answers
77 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
2
votes
1answer
360 views

tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/...
2
votes
0answers
211 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
1answer
398 views

Multilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $$e_1:G_0 \times G_0 \rightarrow G_1$$ $$e_2:G_1 \times G_1 \rightarrow G_T$$ and use this to encrypt a message $M$ in the form $$M e_2(e_1(...
1
vote
2answers
124 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
1
vote
1answer
281 views

Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
6
votes
1answer
2k views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
1
vote
1answer
109 views

How should I define order according to domain parameters in elliptic curve pairing groups?

According to domain parameters, as an example Type 1 pairing domain parameters are ...
1
vote
1answer
410 views

How to calculate secret key size of a CP-ABE scheme

How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme: Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for ...
1
vote
1answer
117 views

Exponent operation over element of G

I found a definition of an exponent operation over the element of $\mathbb{G}$ in this paper (page 4): $$ (g^a)^{\% b} = g ^{a \text{ mod } b}$$ I couldn't understand the rest of the paper (Decrypt ...
0
votes
3answers
463 views

What is the time requirement for pairing computation and modular exponentiation?

I want to design a cryptographic protocol for encrypted search without pairing. I have seen some papers for protocols without pairing. How would I compare pairing computation and modular operations?
-1
votes
1answer
66 views

Security for secret key of server in Identity-based Encryption

In the key set up phase, server generates Pub=s.P, where s is the secret key.Then , it gives clients Pub,P as public parameters and pairing descriptions. Is it possible for clients to pre-compute r.P ...
2
votes
0answers
43 views

no speedup from preprocessing in blynn's PBC library [closed]

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
1
vote
2answers
439 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
1
vote
0answers
289 views

PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
3
votes
1answer
200 views

Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
2
votes
1answer
536 views

How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
1
vote
1answer
188 views

the decryptNode function for leaf nodes in CP-ABE

Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-...
2
votes
1answer
211 views

Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$...