Questions tagged [pairings]
Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.
-1
votes
2answers
94 views
Table of Curve Paramters
I'm studying Elliptic Cruve Cryptograhpy. When I do a search on Google of ECC, I find some pdf where I see these curve's paramters: $q, h, r, exp1, exp2$. What are these parameters ? Are there tables (...
1
vote
1answer
950 views
Variant of the Decisional Bilinear Diffie Hellman problem
I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem:
Let $e: \mathbb G_1 \...
0
votes
1answer
60 views
How to change the following commitment scheme to Pedersen commitment?
In my question here Zero knowledge set membership protocol
The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. ...
10
votes
0answers
159 views
Proving multiple products “in the exponent”
I'm trying to come up with a small-sized (non-interactive) proof for a Diffie-Hellman-like statement.
I'll start by giving an example.
The prover has $g^a, g^b, g^c, g^{ac}, g^{ab}, g^{bc}, g^{abc}$.
...
4
votes
0answers
90 views
Can cryptographically useful pairings only be used with elliptic curves?
As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve.
I was wondering if it is possible to construct pairings from general finite ...
4
votes
0answers
195 views
As a cryptographer, what are the things I should care about in my implementation of pairing functions?
As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing.
I am ...
3
votes
0answers
24 views
If curve bn256/bls12 support the isomorphism from $G_2$ to $G_1$?
Is bn256 or bls12 a type-2 pairing-friendly curve?
As Dan Boneh said here
While in many pairing instantiations this ψ exists naturally, in some instantiations it does not.
However I can not find ...
3
votes
0answers
54 views
Is there a bilinear map on a non abelian group or non cyclic group?
I've recently been studying a pairing map on cryptography.
In usual definition, a pairing map is always defined on the cyclic group G.
Is it possible to construct a bilinear map on a non-abelian group ...
3
votes
0answers
81 views
Pairings over elliptic curves on rings
Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings ...
3
votes
0answers
178 views
Prime extension field encoding ASN.1
ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields.
I'm looking for known ...
3
votes
0answers
212 views
TypeA pairing, elliptic curves in pairing based cryptography
I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given.
type a
...
3
votes
0answers
94 views
Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?
In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking).
Specifically this scheme:
If you look at the ...
2
votes
0answers
27 views
Security strength of JPBC Type A curve compared to SecP curve
I recently encountered some problems when learning about the JPBC library.
Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
2
votes
0answers
59 views
Is this an error in the Pinocchio Protocol paper
I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
2
votes
0answers
202 views
What pairings are used in PBC and charm-crypto with the proposed elliptic curves?
I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
2
votes
0answers
152 views
Frey-Rück Attack (FR-Reduction) - Tate Pairing
I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
2
votes
0answers
228 views
BLS signature choice of generator
Studying the bls signatures, I am wondering how in practice should we handle the parameter G.
In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
2
votes
0answers
48 views
How to use maps in the Boneh Gentry Waters encryption scheme?
I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their ...
2
votes
0answers
206 views
Boneh/Franklin Identity based encryption with Tate pairing
Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 .
I know that this algorithm can also be implemented ...
2
votes
0answers
60 views
Construct points with the same discrete logarithm
Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing
$G_1 \times G_2 \mapsto G_T$
Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$
such that the discrete logarithm $...
2
votes
0answers
177 views
Are the values of Tate and Ate pairing the same?
Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup.
Do then the ...
2
votes
0answers
340 views
Type G Bilinear Pairings
I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...
2
votes
0answers
205 views
Hardware Implementation of Pairing over BN curves
I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
2
votes
0answers
137 views
Type 2 to Type 1 pairing transformation - why not considered?
How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) \...
2
votes
0answers
84 views
For $e(g, d) = c $, can we compute $d$, given others
Given $$e(g, d) = c $$
where,
$e$ is bilinear pairing function chosen by the user/attacker,
the values of $g$ and $c$ are known
$g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$
can we somehow ...
2
votes
0answers
133 views
BLS signatures in the G-valued Random Oracle Model
This paper on semi-generic algorithms considers
"non-standard properties of the employed hash function".
For BLS signatures whose main group is $G$, I'm curious what can
be shown when the hash ...
1
vote
0answers
98 views
How do pairings behave on G2/twist points off the prime order subgroup?
$\newcommand{\F}{\mathbb{F}}$
Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
1
vote
0answers
80 views
Security of BLS under additional information on the secret key
Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
14 views
The multi-linear maps are prone to zeroizing attack. Can anyone explain how the zeroizing attack breaks the computational assumptions?
I read that many cryptographic schemes based on multi-linear mapping are not secure because the zero testing procedure and zero encoding help an adversary to reveal the secrets and because of it, many ...
1
vote
0answers
54 views
What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$
I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work.
I thought the only thing I had to change in my code was the ...
1
vote
0answers
51 views
Complexity lower bound in Uber-Assumption family
I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen
(http://www.academia.edu/download/30698012/...
1
vote
0answers
325 views
Functional signatures with ECDSA Verifier
Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
1
vote
0answers
42 views
Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?
Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
0answers
88 views
Certificate Master Public Key with Pairing
I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
1
vote
0answers
50 views
size of group points and parameters in pairing based cryptography
$$e:G_1\times G_1\rightarrow G_2$$
In symmetric pairing-based cryptography with groups$(G_1,G_2)$ of prime order $q$ and $a,b \in Z_q$Will the size of random generator $P$ from$ G_1$ and $a$ be same?...
1
vote
0answers
278 views
PBC library: group of composite order for pairing operation
How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order.
I want ...
1
vote
0answers
151 views
What is the hardness in Decisional Linear Assumption (DLIN)?
I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem.
I would be grateful if someone can help me to ...
1
vote
0answers
101 views
DLOG in $\mathbb{F}_{p^n}^*$?
Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
1
vote
0answers
236 views
A question about elliptic curves and finite fields in bilinear pairings
Based on what mentioned in the paper "Pairings For Cryptographers"
http://www.sciencedirect.com/science/article/pii/S0166218X08000449
the two inputs of a pairing map are two members of two additive ...
1
vote
0answers
217 views
Bilinear pairing
I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are
point doubling and line function computation
point addition ...
1
vote
0answers
136 views
Why does computing g^a * g^{-a} with the PBC library result in zero?
My example code is as follows:
/*
* Example 1
* 1) Calculate g^a
* 2) calculate g^{-a}
* 3) multiply g^a * g^{-a}
*
*/
Note: here ...
0
votes
0answers
40 views
Prove that a given signature scheme is secure under random message attacks
This is a follow up to my previous question.
Consider the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $...
0
votes
0answers
34 views
Prove that a signature scheme is RUF-NMA and not EUF-CMA
I am working on the following exercise:
Now, assume the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
0
votes
0answers
13 views
Are compressed pairings used for Barreto-Naehrig curves in practice?
In 2009 Galbraith and Lin wrote the article "Computing Pairings Using x-Coordinates Only" https://link.springer.com/article/10.1007/s10623-008-9233-3, where they proposed to compute pairings on ...
0
votes
0answers
80 views
NIST ECC Curves without pairings
NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
0
votes
0answers
75 views
Found weil pairing. Index Calculus method on the results of weil pairing
Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31).
So I tried to solve this using MOV attack.
The torsion point for them E[5] is R(-25,30i) where is sqroot -1
Chosen two ...
0
votes
0answers
113 views
Sextic twist maps to q Eigenspace of Frobenius
Let $E(p)$ be a Barretto-Naehrig elliptic curve with r-torsion and embedding degree 12 and $E'$ a sextic twist with homomorphism $\psi$.
How to show, that
$E'$ has a unique r-torsion group
$\psi$ ...
0
votes
0answers
232 views
Are Barreto-Naehrig Curves suitable for pairing-based cryptography?
If Barreto-Naehrig Curves are suitable for pairing-based cryptography, can I use the library available at Optimal ATE Pairing?
-1
votes
0answers
29 views
What are MNT pairing curves? What is their security?
I am planning to implement a pairing based scheme in sagemath. I found that NIST has not standardized pairing-based elliptic curves, and many people use MNT curves when implementing pairing based ...
