Questions tagged [pairings]
Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.
208
questions
0
votes
0answers
26 views
Where can I find references to the theory behind PBC library?
I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
0
votes
0answers
12 views
what is the non_residue value of BN462
I found an algorithm to find the frobenius coeffs here.
Here, the non_residue of BLS12-381 is -1,
And non_residue of BLS12-377 is written -5.
How can I find this value?
And what is the non_residue ...
1
vote
1answer
71 views
Can I convert $F_{q^{12}}$ to $F_q$?
I seeing a paper about Elliptic curve based proxy re-encryption.
And I want to implement this through BLS12-381 Curve.
However, When looking at the documentation for paring or the library, the value ...
1
vote
1answer
53 views
What is different between G1×G1→GT and G1×G2→GT in the bilinear pairing?
It is an implementation of the bls12-381 algorithm known as pairing-friendly, at GitHub.
Looking at this, the pairing parameters are $G_1$ and $G_2$,
$G_1$ is the point of $F_q$, $G_2$ is the point of ...
0
votes
0answers
24 views
How to estimate the computation overhead of ECDSA?
I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005, 9, and 4.4 ms respectively. I want to ...
1
vote
0answers
28 views
Fixed variable in Groth16
In the paper On the Size of Pairing-based Non-interactive Arguments by Jens Groth, it is always referred in the equations to satisfy that $a_0 = 1$ and the others $a_1, ..., a_m \in \mathbb{F}$.
I am ...
0
votes
0answers
30 views
Can Pedersen commitment be used in pairing groups?
For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
1
vote
1answer
83 views
Current situation of bilinear pairing protocols
The bilinear pairings are considered as the key enabler for many novel cryptographic protocols, such as three-party one round DH[1], shorter signatures and certificateless (ID-based) crypto[3] , which ...
3
votes
1answer
51 views
Understanding the groups used in bilinear Ate-pairing
The bilinear ate pairing $e:G_1\times G_2 \rightarrow G_T$ is defined over the following groups:
\begin{equation}
\begin{aligned}
& G_1 = E(\mathbb{F}_p)[r] \cap Ker(\pi_p-[1]), \\
& G_2 = E(...
2
votes
0answers
38 views
Groth-Sahai Proof of multi-exponentiation
I want to create a NIZK proof of a multi-exponentiation via Groth-Sahai proofs. In the lectures of Jens Groth in a winter school of Bar-Ilan University, he shows a way to transform multi-...
0
votes
0answers
22 views
pairing teta function calculation
I am struggling with some pairing calculation techniques and i do not know how to approach them
I would be glad if anyone can explain them in an easy way.
For example i have these two formulas
1) ...
1
vote
0answers
16 views
Is the k-sum attack efficient in bilinear pairing variants?
From the k-sum definition, the objective is to solve something like:
$\sum_{i=1}^n c_i = v_1$ where $v_1$ is known.
If we use Elliptic Curve Points ($C_i$ and $G$) we can define a bilinear pairing ...
2
votes
1answer
98 views
Bilinear Map over group of unknown order
Is it possible to build a bilinear map where the underlying group is of unknown order?
To maintain context, the original question appears below.
As per poncho's excellent answer, my original idea is ...
0
votes
0answers
29 views
What are the BLS12-381 settings?
I can't find the exact type and settings for the BLS12-381 curve.
Is this type-3 in Symmetric XDH settings ?
0
votes
1answer
67 views
Can BLS aggregate signatures be merged?
In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures?
For example, say you have two aggregate signatures, $...
0
votes
0answers
25 views
Bilinear pairings with groups of safe prime order
I am looking for a curve with a bilinear pairing of safe prime order.
I.e. a bilinear map $G \times G \rightarrow G_T$ where $|G| = p$, $p = 2q +1$, and $p,q$ are both prime.
Is it feasible to find ...
1
vote
0answers
31 views
Pair-friendly elliptic curves vs non friendly
Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
0
votes
0answers
23 views
Schnorr signature verification via Pairing-Based Cryptography?
Let $e: G^{\dagger}_{1} \times G_{2} \mapsto G_{T}$ define the pairing.
Assuming an output $\sigma = (c, p)$ similar to a Schnorr signature:
$s \times Y \mapsto Y_{s}$ and $m \times G \mapsto M$
$c = ...
3
votes
0answers
51 views
Are all MNT curves assumed to hold XDH?
For one of my projects, I need a pairing group which holds the External co-Diffie-Hellman assumption. I am trying to implement it using Charm crypto python modules which provides support for MNT ...
2
votes
1answer
84 views
Variants of Bilinear Diffie-Hellman Assumption
Could someone point me to the paper/reference where the following variant of q-strong Bilinear Diffie-Hellman assumption was used?
Given $s \in \mathbb{Z}_p^*$ and $g, g^{\frac{1}{s}}, g^{s}, g^{s^2},...
1
vote
0answers
26 views
What to learn in order to understand Weil Divisors
My current role as a software developer is leading into areas of research in elliptic-curve-cryptography that keeps bringing me back to bilinear pairings. This includes BLS Signatures, CL Signatures ...
1
vote
1answer
30 views
Group Signatures with VLR Revocation Check
I was reading the paper by Boneh et al. Link. The scheme describes what is called a Verifier Local Revocation Technique. The Scheme assumes that a Revocation List [RL] allows each verifier to check ...
0
votes
0answers
37 views
Accumulation of elements with a bilinear (pairing-based) accumulator
My question concerns accumulation of new elements in bilinear (pairing-based) accumulators.
Suppose you have a pairing $e:\mathbb{G}_1\times \mathbb{G}_2 \longrightarrow \mathbb{G}_T$ with ...
1
vote
1answer
109 views
Calculation of the order of the cosets used in defining the Tate Pairing
I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the preamble to the Tate pairing. (See p. 70 ff., section 5.2 of of the PDF.). I'm having trouble following a ...
0
votes
0answers
60 views
Pairing-free group based encryption scheme
Can someone explain what is a pairing-free group ? There is encryption schemes, for example 1, that qualify there proposed construction as pairing-free group. However, they use bilinear group in the ...
3
votes
1answer
50 views
What's the difference between symmetric and asymmetic multilinear map?
In pairing-based cryptography, we have 3 types, namely Type-I, where $\mathbb{G}_1 = \mathbb{G}_2$, and in Type-II and Type-III we have that $\mathbb{G}_1 \neq \mathbb{G}_2$, however in Type-II we ...
3
votes
0answers
96 views
New Pairing Friendly Curves for SM9
A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)"
SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-...
1
vote
1answer
185 views
Do Weil, Tate, and Ate pairings exist on all elliptic curves?
I don't know much about the math behind elliptic curves.
Do Weil, Tate and Ate pairings exist on all elliptic curves? If the answer is negative, then what pairings do MNT, BN and SS curves have?
...
2
votes
1answer
348 views
What does the number 256 in pairing curve BN256 indicate?
There are many pairing based elliptic curves like MNT curves, BN curves, SS curves etc., When we say BN256 curve, what does the number 256 indicate? Is it some group order or number of bits required ...
1
vote
1answer
102 views
Is there a concept of embedding degree for non-pairing based elliptic curves?
From this post, I learned the concept of embedding degree. Intuitively, if embedding degree of an elliptic curve $E(F_p)$ is $k$, it means there is a way to transform points in $E(F_p)$ to $F_{p^k}$. ...
0
votes
1answer
40 views
Does this equation hold in a bilinear map?
I would like to verify whether or not the following equation holds:
$e(a,c)^{c1\cdot c2\cdot c3}e(b,c)^{c1\cdot c2\cdot c4}==e(a,c)^{c2\cdot c3}e(b,c)^{c1^2\cdot c2\cdot c4}$ for appropriately ...
3
votes
0answers
45 views
If curve bn256/bls12 support the isomorphism from $G_2$ to $G_1$?
Is bn256 or bls12 a type-2 pairing-friendly curve?
As Dan Boneh said here
While in many pairing instantiations this ψ exists naturally, in some instantiations it does not.
However I can not find ...
1
vote
1answer
137 views
Are there any NIST curves with pairings?
NIST FIPS.186-4 has standardized 5 ECC curves on field 𝔽𝑝 (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. None of them seem to have pairings. Are there any standard ...
0
votes
1answer
85 views
Computing a sextic twist
Let $(x,y) \in E'_{\mathbb{F}_{p^2}}$ be a point of the sextic twist.
I am currently trying to compute:
$\psi : (x, y) \leftarrow (\mu^2x,\mu^3y)$ with $\mu \in \mathbb{F}_{p^{12}}$ the root of $(Y^...
2
votes
0answers
49 views
Security strength of JPBC Type A curve compared to SecP curve
I recently encountered some problems when learning about the JPBC library.
Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
1
vote
0answers
113 views
How do pairings behave on G2/twist points off the prime order subgroup?
$\newcommand{\F}{\mathbb{F}}$
Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
0
votes
1answer
57 views
Elliptic Curves for Pairings
how can is possible to know if an elliptic curve is suitable for protocols that adopt pairing?
For example, in Certificateless Cryptography with pairing, is it possible to know if all elliptic curves ...
0
votes
0answers
103 views
Prove that a given signature scheme is secure under random message attacks
This is a follow up to my previous question.
Consider the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : ...
0
votes
0answers
67 views
Prove that a signature scheme is RUF-NMA and not EUF-CMA
I am working on the following exercise:
Now, assume the following signature scheme:
$\operatorname{KeyGen} (1^k$) : On input of a security parameter $k$, choose a symmetric bilinear group with $e : G ...
5
votes
1answer
163 views
Is this an error in the Pinocchio Protocol paper
I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
1
vote
1answer
132 views
How to apply lagrange interpolation on bilinear pairings?
I have seen in some places applications of Shamir secret sharing and lagrange interpolation mixed with bilinear pairings, however I fail to understand how this works. For instance, here I find the ...
3
votes
0answers
71 views
Is there a bilinear map on a non abelian group or non cyclic group?
I've recently been studying a pairing map on cryptography.
In usual definition, a pairing map is always defined on the cyclic group G.
Is it possible to construct a bilinear map on a non-abelian group ...
0
votes
1answer
125 views
How to change the following commitment scheme to Pedersen commitment?
In my question here Zero knowledge set membership protocol
The suggested solution allows a prover to choose a commitment $C$. Then, A trusted third party ($T$) can validate if $C$ is valid or not. ...
0
votes
2answers
83 views
Does this pairing-based signature scheme work?
Suppose $g$ is a pairing-friendly elliptic curve with subgroup generators $G_1$ and $G_2$. Suppose also that $M$ is the message I want to sign.
Setup
Compute $A = a \cdot G_1$ and $P = p \cdot G_2$, ...
2
votes
1answer
126 views
Can we use PHE or SWHE instead of bilinear pairings in ZK-SNARKS?
In ZK Snarks bilinear pairings are used to do "encrypted computation". I was wondering if we can use Partial Homomorphic Encryption or Somewhat Homomorphic Encryption instead of bilinear pairings. Can ...
0
votes
0answers
127 views
NIST ECC Curves without pairings
NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
3
votes
1answer
210 views
Order of twisted curve in pairings
We are doing optimal Ate pairings using a Barreto-Naehrig curve, and I am trying to make sure that an observation I made generalizes.
We define $E$ as $y^2 = x^3 + 3$ and use the tower of extensions
\...
1
vote
1answer
113 views
Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?
In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption,...
1
vote
0answers
114 views
Security of BLS under additional information on the secret key
Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
15 views
The multi-linear maps are prone to zeroizing attack. Can anyone explain how the zeroizing attack breaks the computational assumptions?
I read that many cryptographic schemes based on multi-linear mapping are not secure because the zero testing procedure and zero encoding help an adversary to reveal the secrets and because of it, many ...
