# Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

194 questions
Filter by
Sorted by
Tagged with
2k views

### Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
588 views

### Security of pairing-based cryptography over binary fields regarding new attacks

In the last week, the discrete logarithm problem was broken for the binary fields $\mathbb{F}_{2^{(14 \times 127)}}$ and $\mathbb{F}_{2^{(27 \times 73)}}$. Pairing-based cryptography using binary ...
2k views

### Is pairing based cryptography ready for productive use?

I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps. It's quite hard to understand the underlying fundamentals, especially since there are several ...
8k views

### What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
230 views

### Proving multiple products “in the exponent”

I'm trying to come up with a small-sized (non-interactive) proof for a Diffie-Hellman-like statement. I'll start by giving an example. The prover has $g^a, g^b, g^c, g^{ac}, g^{ab}, g^{bc}, g^{abc}$. ...
628 views

### Pairing-friendly curves in small characteristic fields

There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others. In extension fields GF(p^n), ...
1k views

### in Bilinear pairings, what is the difference between Type 2 and Type 3?

in Bilinear pairings, what is the difference between Type 2 and Type 3? I understand in Type 2, there exists an efficiently computable homomorphic function $\phi : G_2 \rightarrow G_1$ , which is not ...
212 views

### Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
255 views

### Can somebody explain the major contributions of the tenants of the Gödel Prize 2013?

As you may know, the Gödel Prize 2013 will be awarded this year to cryptographers (see this ACM press release). The people awarded are Antoine Joux, the team of Dan Boneh and Matthew K. Franklin. Can ...
2k views

### When do we need composite order groups for bilinear maps and when prime order?

Why we need bilinear groups of composite order? What's the special security property of the composite order group in comparison with one of prime order? To put it in another way when do we need ...
3k views

### How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
846 views

### Alternatives to FHE for secure function evaluation

As a followup to a previous question I asked which was more related to Fully Homomorphic Encryption (FHE), what other cryptographic methods are available for computing a private function on public and/...
554 views

### Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
636 views

### Useful pairings for cryptography

I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact ...
948 views

### Must the order of the groups in a bilinear map be the same?

I've been reading up on bilinear maps and their application to cryptography and one thing I keep seeing hasn't yet clicked. If $e:G_1\times G_2\to G_n$ is a bilinear map, $G_1,G_2,G_n$ are always ...
3k views

Consider the pairing $e: G_1*G_2 \to G_t$. Why we are mapping element from group $G_1$ and group $G_2$ to an element in $G_t$. How are they used in cryptography? What advantages do they provide?
818 views

### BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
438 views

### Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
516 views

### Does Identity-Based Encryption actually solve any problem?

Identity based encryption schemes [*] seem to have great potential in high-latency Delay-Tolerant and mobile, ad-hoc networks since they apparently seem to avoid the need for key negotiation and ...
133 views

### Is this an error in the Pinocchio Protocol paper

I am going through the Pinocchio protocol paper and I need 2 clarifications in the section Protocol 1 (Verifiable Computation from strong QAP). The part that explains the Verify process, which ...
152 views

### Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference?
433 views

11k views

### Simple example for CP-ABE (Ciphertext policy attribute-based encryption)

I'm currently working on Ciphertext Policy Attribute-Based Encryption (CP-ABE). So far I'm only using it with a basic understanding how it actually works. Now I want to understand it a bit better, but ...
In pairing-based cryptography, we have 3 types, namely Type-I, where $\mathbb{G}_1 = \mathbb{G}_2$, and in Type-II and Type-III we have that $\mathbb{G}_1 \neq \mathbb{G}_2$, however in Type-II we ...
I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the Tate pairing. He defines $rE = \{r*P | P \in E(\mathbb{F}_{q^k})\}$ and then forms the quotient group \$E(\...