Questions tagged [pairings]
Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.
23
questions
19
votes
1answer
2k views
Mapping points between elliptic curves and the integers
My primary question is:
Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
14
votes
1answer
2k views
Is pairing based cryptography ready for productive use?
I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps.
It's quite hard to understand the underlying fundamentals, especially since there are several ...
7
votes
3answers
2k views
When do we need composite order groups for bilinear maps and when prime order?
Why we need bilinear groups of composite order? What's the special security property of the composite order group in comparison with one of prime order? To put it in another way when do we need ...
4
votes
1answer
851 views
Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
13
votes
3answers
8k views
What is Identity-Based Encryption (IBE) and why is it “better”?
Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
1
vote
1answer
214 views
the decryptNode function for leaf nodes in CP-ABE
Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-...
-1
votes
1answer
3k views
How to Mathematically Prove the Bilinear Pairing Properties [closed]
I am currently working on Bilinear Pairing.To start my work i need to find the mathematically prove of three properties of bilinear pairing.
Let $ G_{1} $ and $ G_{T} $be a cyclic multiplicative ...
15
votes
1answer
587 views
Security of pairing-based cryptography over binary fields regarding new attacks
In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$.
Pairing-based cryptography using binary ...
5
votes
1answer
438 views
Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?
In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
3
votes
2answers
925 views
What does the linear assumption over bilinear groups mean?
In the abstract of "Cryptography with Tamperable and Leaky Memory", at the end of the 3rd paragraph, the authors say:
In both schemes we rely on the linear assumption over bilinear groups.
What ...
1
vote
1answer
999 views
Variant of the Decisional Bilinear Diffie Hellman problem
I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem:
Let $e: \mathbb G_1 \...
1
vote
1answer
421 views
Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?
I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here.
I am looking into implementing some operations for the BLS signature scheme in ...
4
votes
3answers
545 views
Can you help me understand pairing $e:G \times G \to G_T$ and ( Decision) BDH assumption?
From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$
I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
3
votes
0answers
192 views
Prime extension field encoding ASN.1
ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields.
I'm looking for known ...
6
votes
1answer
636 views
Useful pairings for cryptography
I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
4
votes
1answer
445 views
Why pairing based crypto is suitable for some particular cryptographic primitives?
Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for ...
4
votes
1answer
545 views
Sextic twist optimization of BN pairing - cubic root extraction required?
I found the following paper really interesting:
http://www.researchgate.net/publication/220378229_A_family_of_implementation-friendly_BN_elliptic_curves/file/79e4150b3a773beecd.pdf
It allows ...
3
votes
3answers
467 views
How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?
According to wiki's definition of Bilinear pairing…
Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A ...
3
votes
1answer
235 views
Generalization of the DL-assumption in bilinear group pair
When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then:
Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
2
votes
1answer
585 views
How to calculate mapping in bilinear
I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p
$e: G * G \to G_t$. be a map with the ...
2
votes
1answer
427 views
Pairings in Identity-based encryption vs. Attribute-based encryption
The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and $e:...
1
vote
2answers
214 views
DDH and pairings are not contradictory in RingCT 2.0?
As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0.
How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
0
votes
0answers
52 views
Prove that a signature scheme is RUF-NMA and not EUF-CMA
I am working on the following exercise:
Now, assume the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with ...
