# Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

193 questions
Filter by
Sorted by
Tagged with
66 views

### Security for secret key of server in Identity-based Encryption

In the key set up phase, server generates Pub=s.P, where s is the secret key.Then , it gives clients Pub,P as public parameters and pairing descriptions. Is it possible for clients to pre-compute r.P ...
47 views

### no speedup from preprocessing in blynn's PBC library [closed]

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
449 views

### System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
326 views

### PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
228 views

### Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
580 views

### How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
207 views

### the decryptNode function for leaf nodes in CP-ABE

Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-...
225 views

### Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$...
340 views

### How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
319 views

### Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve ...
816 views

### Concrete example of Weil Pairing

I am trying to find a concrete example of the Weil Pairing. What I have done until now is that I took $E=(x-1)(x-2)(x-3)$ over $F_5$. I took $E=\{\infty,(1,0),(2,0),(3,0)\}$. I know that there ...
91 views

### Can cryptographically useful pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...
61 views

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm $... 0answers 54 views ### Why the group order has to be prime for pairing-based cryptography [duplicate] I'm trying to get into pairing-based cryptography and I don't see why the group order of the group G in the pairing function e:G*G-> G_t has to be a prime number. I don't find an argument why ... 0answers 114 views ### Sextic twist maps to q Eigenspace of Frobenius Let$E(p)$be a Barretto-Naehrig elliptic curve with r-torsion and embedding degree 12 and$E'$a sextic twist with homomorphism$\psi$. How to show, that$E'$has a unique r-torsion group$\psi$... 0answers 198 views ### Are the values of Tate and Ate pairing the same? Assume we have a Baretto Naehrig curve over$GF(p)$and a field extension$GF(p^{12})$given by a minimum polynomial. Let$G \in GF(p)$and$Q \in GF(p^{12})$from the trace 0 subgroup. Do then the ... 1answer 98 views ### In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in$G_1$but not able to decrypt the ciphertexts in$G$? For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either$G$(when only additional homomorphic ... 0answers 162 views ### What is the hardness in Decisional Linear Assumption (DLIN)? I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ... 1answer 668 views ### pairing parameters in PBC library I would like to know what are the pairing parameters of PBC library and what are they used for? Here an example where they are used. I noticed that we can give any file in the param subdirectory. Is ... 1answer 72 views ### Question on Miller's algorithm (change the input m) From the book titled " An Introduction to Mathematical Cryptography" (Chapter 5,page 322), we know that the miller's algorithm returns a function$f_P$whose divisor satisfies $$div(f_P) =m[P]-[mP]-(... 1answer 129 views ### Type of values that can be accumulated in bilinear map (multiplicative) accumulator reg Is there any restriction that the members to be accumulated in bilinear map (multiplicative) accumulator need to be relatively prime to P, where P is the order of the group. 1answer 255 views ### What is more efficient, pairing based cryptography or non pairing based cryptography? [closed] As far as I know non pairing pairing based cryptography is less time consuming than pairing based because, pairing based uses complex operations. Are there any advantages of pairing based cryptography ... 1answer 496 views ### Bilinear pairing arithmetic - cryptographic accumulators For calculating accumulated values for set of elements chosen randomly from, say, \{e_1 ,e_2,...e_n\}\subseteq X we use the formula acc= g^{f(e,s)} where f(e,s)= (e_1+s)(e_2+s).....(e_n+s). ... 1answer 230 views ### Bilinear pairing arithmetic Is this e(g^x,g^yH^z) = e(g^x,g^y)e(g^x,H^z) expression is true? where g is the generator and H \in G 1answer 301 views ### Security proof in pairing based cryptography Let : G_{0} and G_{1} be two multiplicative cyclic groups of prime order p, g be a generator of G_{0} and e be a bilinear map, e : G_0 \times G_0 → G_1 and let 𝐶_{1} = 𝑔^{𝛽𝑠_{1}... 1answer 150 views ### Bilinear map + commitment Let \mathbb{G}_1,\mathbb{G}_2,\mathbb{G}_T be yclic group of the same order and e: \mathbb{G}_1 \times \mathbb{G}_2\rightarrow \mathbb{G}_T, such that u\in \mathbb{G}_1, g \in \mathbb{G}_2, a,b,... 1answer 297 views ### How to compute accumulated values in bilinear map accumulators How to compute g^{1/(e_1+s)}, where g is the generator of group \mathbb G, and e_1 and s are keys? I know only s and g^{e_1}, not e_1. \mathbb G has prime order for some prime p ... 1answer 117 views ### Decryption of message in IBE without random oracle using bilinear pairing registration? I find the following IBE scheme from the videos posted and i don't understand the decryption algorithm, will any one please elaborate the 6th step scheme Setup(\lambda) : (\mathbb{G}, \... 2answers 317 views ### Are Barreto-Naehrig Curves suitable for pairing-based cryptography? If Barreto-Naehrig Curves are suitable for pairing-based cryptography, can I use the library available at Optimal ATE Pairing? 1answer 261 views ### Given g^a, g^b, g^c, g^{1/b}, is it hard to distinguish e(g, g)^{abc} from a random value? where g is a group element in bilinear group \mathbb{G}. I understand it is very similar to the conventional DBDH problem, but g^{1/b} is also known, possibly making it easier? Does anyone know ... 1answer 299 views ### Generating cyclic group for Ciphertext-Policy Attribute-Based Encryption [closed] I am doing Project under the topic CP-ABE.I need to generate a symmetric bilinear group Go of prime order p and with generator g...Then how to choose random elements from Zp....kindly anyone help me...... 1answer 171 views ### Hardness assumptions on composite order bilinear groups [closed] I am not at all knowledgeable in elliptic curve cryptography. So, here lies a couple of questions that I failed to find answers for to my satisfaction. Is there any known Type-III bilinear pairing ... 2answers 4k views ### Is it an example of bilinear pairing? Consider a bilinear pairing e: G_1 \times G_2 \rightarrow G_T. Let's assume, G_1 = G_2 = G_T = (\mathbb{Z}_n,+), i.e. additive group of integer modulo n and e(x,y) = xy mod n. Isn't it an ... 1answer 992 views ### Variant of the Decisional Bilinear Diffie Hellman problem I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let e: \mathbb G_1 \... 1answer 282 views ### Hardness of problem related to bilinear pairings Let e: \mathbb G_1 \times \mathbb G_1 \rightarrow \mathbb G_T be an efficient bilinear pairing. Note that the pairing is symmetric (i.e., Type 1). The problem is, given g \in \mathbb G_1 and e(g,... 2answers 165 views ### Group description in pairing based cryptography Suppose we have a public key encryption scheme, in which public parameter contains (p, G, G_t, e, g), where p is prime number, G is a (cyclic) group of prime order, e:G \times G \mapsto G_t. ... 0answers 202 views ### As a cryptographer, what are the things I should care about in my implementation of pairing functions? As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ... 1answer 444 views ### Symmetric vs non-symmetric pairing based crypto I am trying to find a comparison of how different pairing-friendly elliptic curves perform (in terms of security) in real world applications; I am using PBC library, and it has type A curves and type ... 0answers 110 views ### DLOG in \mathbb{F}_{p^n}^*? Assume that we are given an element g\in \mathbb{F}_{p^n}^* and g does not belong to any of the smaller subfields contained in \mathbb{F}_{p^n}. If the degree of g is some number q, how much ... 1answer 122 views ### Does the following linear equation hold in bilinear pairings? Does the following hold in bilinear pairings?$$e(g^{a_1x_1}g^{a_2x_2},g^{c_1}g^{c_2})=e(g^{x_1+x_2},g^{a_1a_2(c_1+c_2)})$$1answer 434 views ### Generic group model: use of polynomials in the proof of the master theorem I've been looking at the paper of Boneh, Boyen, Goh Hierarchical Identity Based Encryption with Constant Size Ciphertext which contains a general theorem (Theorem A.2) about the advantage of an ... 0answers 354 views ### Type G Bilinear Pairings I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,... 2answers 118 views ### linear computations over bilinear pairings Does this hold in asymetric bilinear pairings? e(x_1,x_2)e(x_3,x_4) = e(x_1x_3,x_2x_4), where x_1,x_3 \in \mathbb{G}_1 and x_2,x_4 \in \mathbb{G}_2 for a bilinear pairing e 0answers 206 views ### Hardware Implementation of Pairing over BN curves I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ... 0answers 251 views ### A question about elliptic curves and finite fields in bilinear pairings Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ... 2answers 298 views ### pairing-based schemes some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would ... 1answer 183 views ### Simplification of a pairing The paper Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage contains the following simplification:$$e(C_i,\text{GPK}_{uid})\cdot e(D_i, K_{\rho(i),uid})\... 0answers 143 views ### Type 2 to Type 1 pairing transformation - why not considered? How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting$e' : G_2 \times G_2 \rightarrow \mu, (P,Q) \...
I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite ...