# Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

268 questions
Filter by
Sorted by
Tagged with
101 views

### BLS curve with a smaller modulus?

To achieve approximately 128 bits of security, curve BLS12-381 uses 381 bits to encode the X coordinate. This means the size of a group element needs at least 48B to store/transmit. I am in a ...
119 views

### Problem with efficiency of projective coordinates in Elliptic Curve arithmetic

Ok sort of long post incoming. Will go slow to make it as clear as possible I'm trying to build a C library for Elliptic Curve Arithmetic. Since the idea is to learn from the process, I decided to ...
• 95
1 vote
70 views

### Hashing to the target group of bilinear pairing

Assuming we have fixed pairing friendly elliptic curve groups $G_1$, $G_2$ and $G_T$ where for $a \in G_1$ and $b \in G_T$ it holds $e(a,b) \in G_T$. Let's put some more context and we are working in ...
• 6,150
1 vote
52 views

### Similar to Diffie Hellman for BLS in asymmetric pairing?

I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
1 vote
69 views
+50

### One-More Computational co-Diffie-Hellman in asymmetric pairing groups

I am writing a paper and having one issue. In a part of protocol, I need to perform one step similar to OPAQUE to calculate, $s_{mi} = H_m(i)^{x_m}$, where ${x_m}$ is a server specific secret and ...
30 views

### Safe use of bilinear pairing, using one way function in the exponent

Given a generator $g$ of a cyclic group, I am trying to look for a case where I use pairing over an element that has an exponent which is a one-way function, e.g., $g^{x^2\mod n}$ (here $x$ in the ...
• 99
1 vote
57 views

### Why the full $r$-torsion group contains $r^2$ many elements and consists of $r+1$ subgroups

let $F$ be a finite field, $E(F)$ an elliptic curve of order $n$, $r$ a factor of $n$, $k(r)$ for the embedding degree of $E(F)$ with respect to $r$. Then why the full $r$-torsion group contains $r^2$...
• 111
17 views

### Are there two curves that can be mapped between with a 2-isogeny that support pairing checks and Montgomery ladders?

Are there two curves that can be mapped between using a 2-isogeny that support pairing checks on on curve and Montgomery ladders on another? Is there a paper?
• 11
1 vote
24 views

### Is there a curve that supports both pairing checks and Montgomery ladders?

Is there a curve that supports both? Or are there two curves that can be mapped between using a 2-isogeny that support pairing checks on one and Montgomery ladders on the other? Is there a paper on it?...
• 11
75 views

• 732
64 views

### Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?

​I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
• 368
51 views

• 732
127 views

### Bilinear pairing for compact BLS signature

What family of bilinear pairing is recommendable for BLS signature when the overriding criteria is compactness of the signature, as desirable for something to be keyed-in from printout, or embedded in ...
• 140k
80 views

### Importance of non-degeneracy property of bilinear map for cryptography

I'm currently looking into pairing-based cryptography and I stumbled upon the definition of the properties bilinearity, computability and non-degeneracy. Now I have a problem with understanding the ...
1 vote
171 views

### What is a practical application of evaluating at a point in the Kate Polynomial Commitment Scheme?

I understand how the Kate Polynomial Commitment Scheme Evaluation Proof works however, I don't understand what is the purpose of it? In general, in a commitment scheme, Peggy commits to message & ...
• 2,199
108 views

• 247
1 vote
43 views

### Norm() of bilinear pairing

Consider two points P, Q over a pairing friendly elliptic curve $E[F_q]$, e.g., BN254. Let Z = e(P, Q). It is known that $Z \in F_{q^k}$ where $k$ is the embedding degree. The norm map N(Z) is defined ...
• 99
505 views

### How to have a hash function that maps any binary string of size n to binary string of size n?

I am implementing certificateless cryptography from this research paper in python language. Essentially, I want to have the following hash function mapping. This hash function is mentioned in the ...
• 43
390 views

### What is a function on a Line or a Curve?

I am reading up on Pairings using Elliptic curves & all the texts talk about functions on a Curve. I am finding it difficult to even figure out what they mean by "function on a curve" or ...
• 2,199
344 views

### Size of group elements in a bilinear context

In a asymetric pairing context, which size (in bits) should have the elements of $\mathbb{G}_1,\mathbb{G}_2$ and $\mathbb{G}_T$ if we consider the most efficient elliptic curves?
• 2,575
397 views

### How to have a hash function that maps from a group element to a binary string of a certain size in charm-crypto?

I am facing a problem in programming with the charm-crypto library. The hash functions for pairing group elements in charm-crypto can only map from a string to a specific field: $\mathbb Z_r$, $G_1$ ...
• 43
1 vote
78 views

### Developments in ABE using Pairings

What are the recent developments in Attribute-Based Encryption (ABE) using Pairings assumptions? Is pairings the most viable assumption while designing ABE. What other assumptions are used for ABE ...
1 vote
114 views

### Multiplication of pairings vs. exponentiation of the group elements

Assume that we have a pairing as $e:G_1\times G_2\rightarrow G_T$. such that $g_1$ and $g_2$ are the generator of $G_1$ and $G_2$ respectively. In a protocol I have $A=\prod_{i=1}^n e(H(i),pk_i)$ ...
• 405
1 vote
Are there any pairing-friendly curves whose group order is a safe prime? That is: the order of the group is $2q + 1$ for some prime number $q$. Or, is it impossible to have such groups?