Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

Filter by
Sorted by
Tagged with
1
vote
1answer
126 views

Linkable Ring Signatures on Pairing-Friendly curves

I'm working on a pairing-friendly (Barreto-Naehrig) elliptic curve. If I understand correctly, one consequence of this is that the Decisional Diffie-Hellman assumption no longer holds, but the ...
2
votes
0answers
218 views

What pairings are used in PBC and charm-crypto with the proposed elliptic curves?

I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
3
votes
1answer
81 views

Question about the location of the r-torsion in the quotient group used in the Tate pairing

I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the Tate pairing. He defines $rE = \{r*P | P \in E(\mathbb{F}_{q^k})\}$ and then forms the quotient group $E(\...
2
votes
1answer
96 views

Usage of twists at pairing-based cryptography

First of all I would like to understand how twists are used in pairings. The 2nd step is, how to use them to improve the calculation speed? Say $E'(\mathbb F_{p^2})$ is a twist of $E(\mathbb F_p)$. ...
1
vote
1answer
455 views

Usage of pairings in proxy re-encryption algorithm

I am having trouble understanding one part of the AFGH algorithm for proxy re-encryption (my background in discrete mathematics is lacking a bit). The paper describes the algorithm setup the ...
1
vote
0answers
95 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
3
votes
1answer
335 views

Can Curve25519 be used for pairing-based cryptography?

We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more ...
2
votes
0answers
184 views

Frey-Rück Attack (FR-Reduction) - Tate Pairing

I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
3
votes
1answer
201 views

Does the following Diffie-Hellman problem hold in bilinear groups $G\times G \rightarrow G_T$

For every PPT distinguisher A there exists a negligible function $neg(·)$ such that for all $\lambda$ $|\Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^{ab}) = 1] - \Pr[A(1^\lambda, g,g_1^a,g_1^b,g_1^z) = 1]| \...
1
vote
1answer
343 views

Bilinear Form: Weil pairing

I am doing an example on Weil pairings, and for that purpose I follow the thesis of Alex Edward Aftuck, The Weil Pairing on Elliptic Curves and Its Cryptographic Applications. By following his thesis,...
3
votes
0answers
188 views

Prime extension field encoding ASN.1

ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields. I'm looking for known ...
6
votes
1answer
524 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
10
votes
1answer
205 views

Are pairings still the most efficient implementation for identity and attribute-based encryption?

I read on Wikipedia: [...] pairings have also been used to construct many cryptographic systems for which no other efficient implementation is known, such as identity based encryption or attribute ...
4
votes
1answer
396 views

Pairing on FourQ

How would you define a pairing on the - so called - curve "Four$\mathbb Q$? Since FourQ is a twisted Edwards curve, given by $E/\mathbb F_{q}:\ -x^2+y^2 = 1+dx^2y^2$, where $d\in\mathbb F_p(i), q=p^2,...
4
votes
2answers
201 views

Special-purpose witness encryption without multilinear maps

In Witness Encryption and its Applications Garg et al describe "witness encryption" which allows one to encrypt some specified data to a NP problem, such that another party can decrypt iff they ...
1
vote
1answer
162 views

Is it safe to use pairing-based cryptography in a commercial product?

My findings don't show any standardization(NIST, FIPS?) of pairing-based cryptography. Would this mean that it is a bad idea to incorporate pairing-based cryptography(bilinear groups) within a ...
3
votes
1answer
87 views

Does pairings based cryptography inherently require a CRS/trusted setup?

In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always ...
4
votes
1answer
296 views

Frobenius Map on BN Curve sextic twist?

I'm new to cryptography and I am working on R-ate Pairings on a BN Curve: $y^2=x^3+b$ with $b$=5 with its M-type twist: $y^2=x^3+b\beta$, and $\beta^2 = -2$. The base finite field characteristic ...
5
votes
1answer
792 views

BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
0
votes
1answer
211 views

How can I plot graphs of CP-ABE scheme using charm crypto?

Can I use charm crypto tool to run it over my datasets for CPABE scheme and plot graphs using its Benchmarking tool ? Or, how can I use Charm Crypto tool with CPABE toolkit ?
3
votes
1answer
109 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
2
votes
0answers
74 views

How to construct a hash function that maps any binary string into a multiplicative group element? [duplicate]

Pairing based cryptography schemes such as identity-based encryption or different attribute-based encryption schemes (CP-ABE, KP-ABE etc.) often make use of a hash function defined as $H_1:\{0,1\}^* \...
2
votes
2answers
1k views

Decisional Diffie-Hellman assumption vs decisional bilinear Diffie-Hellman assumption

For the Decisional Diffie-Hellman (DDH) assumption we know that: Given $g^a$ and $g^b$ for uniformly and independently chosen $a,b \in Z_p$ the value of $g^{ab}$ looks like a random value in group $\...
0
votes
2answers
183 views

Pairing - Is it possible to map two $r$-torsion points to a $r^2$-torsion point?

Let $E(\mathbb F_{q^k})$ be an elliptic curve on finite field $\mathbb F_{q^k}$, where $\mathbb F_{q^k}$ is an extension of $\mathbb F_q$ with $k>1$. Let $e: G_1 \times G_2 \rightarrow G_t$ be a ...
0
votes
1answer
96 views

Order of target group in pairing

Let $N=pq$, where $p$ and $q$ are prime numbers, and order of $G_1$ and $G_2$ is equal to $p$. Suppose that $e(G_1, G_2)=G_t$ is a pairing of composite order. I know that, usually the order of target ...
3
votes
1answer
205 views

Order of target group in bilinear pairing

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers. Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ ...
3
votes
0answers
240 views

TypeA pairing, elliptic curves in pairing based cryptography

I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given. type a ...
1
vote
0answers
54 views

size of group points and parameters in pairing based cryptography

$$e:G_1\times G_1\rightarrow G_2$$ In symmetric pairing-based cryptography with groups$(G_1,G_2)$ of prime order $q$ and $a,b \in Z_q$Will the size of random generator $P$ from$ G_1$ and $a$ be same?...
0
votes
1answer
230 views

Multiplication vs exponentiation in pairing based cryptography

$$P\in G_1$$$$Q\in G_1$$ $$a,b \in Z_q$$ $G_1$ isadditive cyclic group of prime order $q$ $$e(P^{a+b},Q)------(1)$$ $$e(aP+bP,Q)----(2)$$ (1) and (2) will give the same pairing result ...
2
votes
0answers
257 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
1
vote
1answer
83 views

Can I use computational diffie hellman problem in the following scheme?

Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$ $X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public. $m,n,r$ are randomly chosen from $Z_q$. Anybody who knows $(1/r)$ can ...
-1
votes
2answers
96 views

Table of Curve Paramters

I'm studying Elliptic Cruve Cryptograhpy. When I do a search on Google of ECC, I find some pdf where I see these curve's paramters: $q, h, r, exp1, exp2$. What are these parameters ? Are there tables (...
3
votes
3answers
448 views

How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?

According to wiki's definition of Bilinear pairing… Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A ...
2
votes
2answers
296 views

Choice of bilinear group for implementation of BLS signature with NIWI proof?

I am trying to sign the multiple (millions of) different readings but the receiver should not be able to link multiple signed readings together (unlinkability) or with the identity of the signer (...
2
votes
0answers
50 views

How to use maps in the Boneh Gentry Waters encryption scheme?

I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their ...
1
vote
1answer
158 views

Do I need to prove this?

I am using ABE scheme that has already proven under BDHE assumption. Here is the scheme https://eprint.iacr.org/2008/290.pdf In the key generation algorithm, I want to tie the user secret key ...
1
vote
1answer
90 views

Given $ g^s, g^y , g^r, g^t, g^{st-rs}, g^{(yr+d)/t}$ , is it hard to distinguish $e(g,g)^{syr}$ from a random value?

Where $g$ is a group element in bilinear group $G$, $e(g,g)∈GT$ and $s, y, r, t, d$ are randomly chosen. I understand it is very similar to the conventional DBDH problem, but $g^t, g^{st-rs}, g^{(yr+...
5
votes
1answer
152 views

Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference?
0
votes
0answers
82 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
2
votes
1answer
370 views

tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/...
2
votes
0answers
220 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
1answer
424 views

Multilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $$e_1:G_0 \times G_0 \rightarrow G_1$$ $$e_2:G_1 \times G_1 \rightarrow G_T$$ and use this to encrypt a message $M$ in the form $$M e_2(e_1(...
1
vote
2answers
125 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
1
vote
1answer
298 views

Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
6
votes
1answer
3k views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
1
vote
1answer
115 views

How should I define order according to domain parameters in elliptic curve pairing groups?

According to domain parameters, as an example Type 1 pairing domain parameters are ...
2
votes
1answer
429 views

How to calculate secret key size of a CP-ABE scheme

How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme: Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for ...
1
vote
1answer
118 views

Exponent operation over element of G

I found a definition of an exponent operation over the element of $\mathbb{G}$ in this paper (page 4): $$ (g^a)^{\% b} = g ^{a \text{ mod } b}$$ I couldn't understand the rest of the paper (Decrypt ...
0
votes
3answers
497 views

What is the time requirement for pairing computation and modular exponentiation?

I want to design a cryptographic protocol for encrypted search without pairing. I have seen some papers for protocols without pairing. How would I compare pairing computation and modular operations?
-1
votes
1answer
66 views

Security for secret key of server in Identity-based Encryption

In the key set up phase, server generates Pub=s.P, where s is the secret key.Then , it gives clients Pub,P as public parameters and pairing descriptions. Is it possible for clients to pre-compute r.P ...