Questions tagged [pairings]
Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.
61
questions with no upvoted or accepted answers
5
votes
0answers
97 views
Can cryptographically useful pairings only be used with elliptic curves?
As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve.
I was wondering if it is possible to construct pairings from general finite ...
5
votes
0answers
214 views
As a cryptographer, what are the things I should care about in my implementation of pairing functions?
As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing.
I am ...
3
votes
0answers
60 views
Are all MNT curves assumed to hold XDH?
For one of my projects, I need a pairing group which holds the External co-Diffie-Hellman assumption. I am trying to implement it using Charm crypto python modules which provides support for MNT ...
3
votes
0answers
114 views
New Pairing Friendly Curves for SM9
A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)"
SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-...
3
votes
0answers
49 views
If curve bn256/bls12 support the isomorphism from $G_2$ to $G_1$?
Is bn256 or bls12 a type-2 pairing-friendly curve?
As Dan Boneh said here
While in many pairing instantiations this ψ exists naturally, in some instantiations it does not.
However I can not find ...
3
votes
0answers
82 views
Is there a bilinear map on a non abelian group or non cyclic group?
I've recently been studying a pairing map on cryptography.
In usual definition, a pairing map is always defined on the cyclic group G.
Is it possible to construct a bilinear map on a non-abelian group ...
3
votes
0answers
102 views
Pairings over elliptic curves on rings
Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings ...
3
votes
0answers
202 views
Prime extension field encoding ASN.1
ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields.
I'm looking for known ...
3
votes
0answers
271 views
TypeA pairing, elliptic curves in pairing based cryptography
I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given.
type a
...
3
votes
0answers
94 views
Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?
In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).
Specifically this scheme:
If you look at the ...
2
votes
0answers
45 views
Groth-Sahai Proof of multi-exponentiation
I want to create a NIZK proof of a multi-exponentiation via Groth-Sahai proofs. In the lectures of Jens Groth in a winter school of Bar-Ilan University, he shows a way to transform multi-...
2
votes
0answers
58 views
Security strength of JPBC Type A curve compared to SecP curve
I recently encountered some problems when learning about the JPBC library.
Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
2
votes
0answers
459 views
Functional signatures with ECDSA Verifier
Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
2
votes
0answers
248 views
What pairings are used in PBC and charm-crypto with the proposed elliptic curves?
I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
2
votes
0answers
367 views
Frey-Rück Attack (FR-Reduction) - Tate Pairing
I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
2
votes
0answers
281 views
BLS signature choice of generator
Studying the bls signatures, I am wondering how in practice should we handle the parameter G.
In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
2
votes
0answers
58 views
How to use maps in the Boneh Gentry Waters encryption scheme?
I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their ...
2
votes
0answers
253 views
Boneh/Franklin Identity based encryption with Tate pairing
Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 .
I know that this algorithm can also be implemented ...
2
votes
0answers
62 views
Construct points with the same discrete logarithm
Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing
$G_1 \times G_2 \mapsto G_T$
Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$
such that the discrete logarithm $...
2
votes
0answers
205 views
Are the values of Tate and Ate pairing the same?
Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup.
Do then the ...
2
votes
0answers
375 views
Type G Bilinear Pairings
I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...
2
votes
0answers
208 views
Hardware Implementation of Pairing over BN curves
I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
2
votes
0answers
146 views
Type 2 to Type 1 pairing transformation - why not considered?
How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) \...
2
votes
0answers
85 views
For $e(g, d) = c $, can we compute $d$, given others
Given $$e(g, d) = c $$
where,
$e$ is bilinear pairing function chosen by the user/attacker,
the values of $g$ and $c$ are known
$g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$
can we somehow ...
2
votes
0answers
148 views
BLS signatures in the G-valued Random Oracle Model
This paper on semi-generic algorithms considers
"non-standard properties of the employed hash function".
For BLS signatures whose main group is $G$, I'm curious what can
be shown when the hash ...
1
vote
0answers
22 views
How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?
In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about ...
1
vote
0answers
33 views
Fixed variable in Groth16
In the paper On the Size of Pairing-based Non-interactive Arguments by Jens Groth, it is always referred in the equations to satisfy that $a_0 = 1$ and the others $a_1, ..., a_m \in \mathbb{F}$.
I am ...
1
vote
0answers
17 views
Is the k-sum attack efficient in bilinear pairing variants?
From the k-sum definition, the objective is to solve something like:
$\sum_{i=1}^n c_i = v_1$ where $v_1$ is known.
If we use Elliptic Curve Points ($C_i$ and $G$) we can define a bilinear pairing ...
1
vote
0answers
32 views
Pair-friendly elliptic curves vs non friendly
Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
1
vote
0answers
29 views
What to learn in order to understand Weil Divisors
My current role as a software developer is leading into areas of research in elliptic-curve-cryptography that keeps bringing me back to bilinear pairings. This includes BLS Signatures, CL Signatures ...
1
vote
0answers
114 views
How do pairings behave on G2/twist points off the prime order subgroup?
$\newcommand{\F}{\mathbb{F}}$
Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
1
vote
0answers
119 views
Security of BLS under additional information on the secret key
Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
15 views
The multi-linear maps are prone to zeroizing attack. Can anyone explain how the zeroizing attack breaks the computational assumptions?
I read that many cryptographic schemes based on multi-linear mapping are not secure because the zero testing procedure and zero encoding help an adversary to reveal the secrets and because of it, many ...
1
vote
0answers
56 views
What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$
I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work.
I thought the only thing I had to change in my code was the ...
1
vote
0answers
45 views
Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?
BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
1
vote
0answers
55 views
Complexity lower bound in Uber-Assumption family
I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen
(http://www.academia.edu/download/30698012/...
1
vote
0answers
44 views
Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?
Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
0answers
104 views
Certificate Master Public Key with Pairing
I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
1
vote
0answers
56 views
size of group points and parameters in pairing based cryptography
$$e:G_1\times G_1\rightarrow G_2$$
In symmetric pairing-based cryptography with groups$(G_1,G_2)$ of prime order $q$ and $a,b \in Z_q$Will the size of random generator $P$ from$ G_1$ and $a$ be same?...
1
vote
0answers
85 views
Found weil pairing. Index Calculus method on the results of weil pairing
Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31).
So I tried to solve this using MOV attack.
The torsion point for them E[5] is R(-25,30i) where is sqroot -1
Chosen two ...
1
vote
0answers
358 views
PBC library: group of composite order for pairing operation
How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order.
I want ...
1
vote
0answers
184 views
What is the hardness in Decisional Linear Assumption (DLIN)?
I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem.
I would be grateful if someone can help me to ...
1
vote
0answers
123 views
DLOG in $\mathbb{F}_{p^n}^*$?
Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
1
vote
0answers
268 views
A question about elliptic curves and finite fields in bilinear pairings
Based on what mentioned in the paper "Pairings For Cryptographers"
http://www.sciencedirect.com/science/article/pii/S0166218X08000449
the two inputs of a pairing map are two members of two additive ...
1
vote
0answers
240 views
Bilinear pairing
I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are
point doubling and line function computation
point addition ...
1
vote
0answers
152 views
Why does computing g^a * g^{-a} with the PBC library result in zero?
My example code is as follows:
/*
* Example 1
* 1) Calculate g^a
* 2) calculate g^{-a}
* 3) multiply g^a * g^{-a}
*
*/
Note: here ...
1
vote
2answers
1k views
Variant of the Decisional Bilinear Diffie Hellman problem
I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem:
Let $e: \mathbb G_1 \...
0
votes
0answers
25 views
How to prove possession of a CL signature in zero-knowledge?
Assume that we have the following signature scheme CL Signature:
Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$.
Uniformly and ...
0
votes
1answer
74 views
Exponentiation Problem of G2 in MNT curve
I made a simple python program in the Charm framework (https://github.com/JHUISI/charm):
...
0
votes
0answers
30 views
Where can I find references to the theory behind PBC library?
I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
