Questions tagged [pairings]
Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.
28
questions
20
votes
1answer
3k views
Mapping points between elliptic curves and the integers
My primary question is:
Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
7
votes
3answers
2k views
When do we need composite order groups for bilinear maps and when prime order?
Why we need bilinear groups of composite order? What's the special security property of the composite order group in comparison with one of prime order? To put it in another way when do we need ...
4
votes
1answer
2k views
Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
14
votes
1answer
2k views
Is pairing based cryptography ready for productive use?
I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps.
It's quite hard to understand the underlying fundamentals, especially since there are several ...
13
votes
3answers
9k views
What is Identity-Based Encryption (IBE) and why is it "better"?
Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
2
votes
2answers
657 views
Are Barreto-Naehrig Curves suitable for pairing-based cryptography?
If Barreto-Naehrig Curves are suitable for pairing-based cryptography, can I use the library available at Optimal ATE Pairing?
1
vote
1answer
264 views
the decryptNode function for leaf nodes in CP-ABE
Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-...
-1
votes
1answer
3k views
How to Mathematically Prove the Bilinear Pairing Properties [closed]
I am currently working on Bilinear Pairing.To start my work i need to find the mathematically prove of three properties of bilinear pairing.
Let $ G_{1} $ and $ G_{T} $be a cyclic multiplicative ...
15
votes
1answer
623 views
Security of pairing-based cryptography over binary fields regarding new attacks
In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$.
Pairing-based cryptography using binary ...
6
votes
1answer
519 views
Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?
In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
11
votes
2answers
2k views
in Bilinear pairings, what is the difference between Type 2 and Type 3?
in Bilinear pairings, what is the difference between Type 2 and Type 3?
I understand in Type 2, there exists an efficiently computable homomorphic function $\phi : G_2 \rightarrow G_1$ , which is not ...
3
votes
2answers
1k views
What does the linear assumption over bilinear groups mean?
In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say:
In both schemes we rely on the linear assumption over bilinear groups.
What ...
2
votes
4answers
1k views
Variant of the Decisional Bilinear Diffie Hellman problem
I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem:
Let $e: \mathbb G_1 \...
1
vote
1answer
457 views
Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?
I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here.
I am looking into implementing some operations for the BLS signature scheme in ...
4
votes
3answers
633 views
Can you help me understand pairing $e:G \times G \to G_T$ and ( Decision) BDH assumption?
From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$
I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
3
votes
1answer
555 views
Can Curve25519 be used for pairing-based cryptography?
We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more ...
3
votes
3answers
771 views
How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?
According to wiki's definition of Bilinear pairing…
Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A ...
3
votes
0answers
206 views
Prime extension field encoding ASN.1
ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields.
I'm looking for known ...
6
votes
1answer
682 views
Useful pairings for cryptography
I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
4
votes
1answer
640 views
Sextic twist optimization of BN pairing - cubic root extraction required?
I found the following paper really interesting:
http://www.researchgate.net/publication/220378229_A_family_of_implementation-friendly_BN_elliptic_curves/file/79e4150b3a773beecd.pdf
It allows ...
4
votes
1answer
466 views
Why pairing based crypto is suitable for some particular cryptographic primitives?
Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ...
3
votes
1answer
126 views
How to achieve identity authentication without revealing credentials
I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
3
votes
1answer
336 views
Generalization of the DL-assumption in bilinear group pair
When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then:
Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
2
votes
1answer
697 views
How to calculate mapping in bilinear
I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p
$e: G * G \to G_t$. be a map with the ...
2
votes
1answer
471 views
Pairings in Identity-based encryption vs. Attribute-based encryption
The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and $e:...
1
vote
2answers
282 views
DDH and pairings are not contradictory in RingCT 2.0?
As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0.
How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
0
votes
0answers
98 views
Prove that a signature scheme is RUF-NMA and not EUF-CMA
I am working on the following exercise:
Now, assume the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G ...
0
votes
1answer
162 views
Does the following linear equation hold in bilinear pairings?
Does the following hold in bilinear pairings?
$$e(g^{a_1x_1}g^{a_2x_2},g^{c_1}g^{c_2})=e(g^{x_1+x_2},g^{a_1a_2(c_1+c_2)})$$