Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

Filter by
Sorted by
Tagged with
4
votes
1answer
335 views

Frobenius Map on BN Curve sextic twist?

I'm new to cryptography and I am working on R-ate Pairings on a BN Curve: $y^2=x^3+b$ with $b$=5 with its M-type twist: $y^2=x^3+b\beta$, and $\beta^2 = -2$. The base finite field characteristic ...
5
votes
1answer
993 views

BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
0
votes
1answer
287 views

How can I plot graphs of CP-ABE scheme using charm crypto?

Can I use charm crypto tool to run it over my datasets for CPABE scheme and plot graphs using its Benchmarking tool ? Or, how can I use Charm Crypto tool with CPABE toolkit ?
3
votes
1answer
116 views

Proof of a key agreement protocol based on bilinear pairings

I'm currently trying to understand a proof of a protocol of the paper of Liqun Chen and Caroline Kudla entitled "Identity Based Authenticated Key Agreement Protocols from Pairings". You can find a ...
2
votes
0answers
133 views

How to construct a hash function that maps any binary string into a multiplicative group element? [duplicate]

Pairing based cryptography schemes such as identity-based encryption or different attribute-based encryption schemes (CP-ABE, KP-ABE etc.) often make use of a hash function defined as $H_1:\{0,1\}^* \...
2
votes
2answers
2k views

Decisional Diffie-Hellman assumption vs decisional bilinear Diffie-Hellman assumption

For the Decisional Diffie-Hellman (DDH) assumption we know that: Given $g^a$ and $g^b$ for uniformly and independently chosen $a,b \in Z_p$ the value of $g^{ab}$ looks like a random value in group $\...
0
votes
2answers
204 views

Pairing - Is it possible to map two $r$-torsion points to a $r^2$-torsion point?

Let $E(\mathbb F_{q^k})$ be an elliptic curve on finite field $\mathbb F_{q^k}$, where $\mathbb F_{q^k}$ is an extension of $\mathbb F_q$ with $k>1$. Let $e: G_1 \times G_2 \rightarrow G_t$ be a ...
0
votes
1answer
129 views

Order of target group in pairing

Let $N=pq$, where $p$ and $q$ are prime numbers, and order of $G_1$ and $G_2$ is equal to $p$. Suppose that $e(G_1, G_2)=G_t$ is a pairing of composite order. I know that, usually the order of target ...
3
votes
1answer
247 views

Order of target group in bilinear pairing

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers. Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ ...
3
votes
0answers
289 views

TypeA pairing, elliptic curves in pairing based cryptography

I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given. type a ...
1
vote
0answers
61 views

size of group points and parameters in pairing based cryptography

$$e:G_1\times G_1\rightarrow G_2$$ In symmetric pairing-based cryptography with groups$(G_1,G_2)$ of prime order $q$ and $a,b \in Z_q$Will the size of random generator $P$ from$ G_1$ and $a$ be same?...
0
votes
1answer
351 views

Multiplication vs exponentiation in pairing based cryptography

$$P\in G_1$$$$Q\in G_1$$ $$a,b \in Z_q$$ $G_1$ isadditive cyclic group of prime order $q$ $$e(P^{a+b},Q)------(1)$$ $$e(aP+bP,Q)----(2)$$ (1) and (2) will give the same pairing result ...
2
votes
0answers
295 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
2
votes
1answer
110 views

Can I use computational diffie hellman problem in the following scheme?

Suppose $$X=mnrP , Y=\frac{1}{n}Q, R=e(P,Q)^m$$ $X,Y,P,Q$ are randomly chosen from $G_1$.And only $X,Y$ is given in public. $m,n,r$ are randomly chosen from $Z_q$. Anybody who knows $(1/r)$ can ...
-1
votes
2answers
103 views

Table of Curve Paramters

I'm studying Elliptic Cruve Cryptograhpy. When I do a search on Google of ECC, I find some pdf where I see these curve's paramters: $q, h, r, exp1, exp2$. What are these parameters ? Are there tables (...
3
votes
3answers
757 views

How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?

According to wiki's definition of Bilinear pairing… Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A ...
2
votes
2answers
377 views

Choice of bilinear group for implementation of BLS signature with NIWI proof?

I am trying to sign the multiple (millions of) different readings but the receiver should not be able to link multiple signed readings together (unlinkability) or with the identity of the signer (...
2
votes
0answers
60 views

How to use maps in the Boneh Gentry Waters encryption scheme?

I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their ...
1
vote
1answer
164 views

Do I need to prove this?

I am using ABE scheme that has already proven under BDHE assumption. Here is the scheme https://eprint.iacr.org/2008/290.pdf In the key generation algorithm, I want to tie the user secret key ...
1
vote
1answer
98 views

Given $ g^s, g^y , g^r, g^t, g^{st-rs}, g^{(yr+d)/t}$ , is it hard to distinguish $e(g,g)^{syr}$ from a random value?

Where $g$ is a group element in bilinear group $G$, $e(g,g)∈GT$ and $s, y, r, t, d$ are randomly chosen. I understand it is very similar to the conventional DBDH problem, but $g^t, g^{st-rs}, g^{(yr+...
5
votes
1answer
159 views

Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference?
0
votes
0answers
90 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
2
votes
1answer
513 views

tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/...
2
votes
0answers
259 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
1answer
487 views

Multilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $$e_1:G_0 \times G_0 \rightarrow G_1$$ $$e_2:G_1 \times G_1 \rightarrow G_T$$ and use this to encrypt a message $M$ in the form $$M e_2(e_1(...
1
vote
2answers
145 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
1
vote
1answer
390 views

Non-Degeneracy of the Weil pairing

In this YouTube video, Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
6
votes
1answer
3k views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
1
vote
1answer
129 views

How should I define order according to domain parameters in elliptic curve pairing groups?

According to domain parameters, as an example Type 1 pairing domain parameters are ...
2
votes
1answer
506 views

How to calculate secret key size of a CP-ABE scheme

How can I calculate the real size of key in a CP-ABE scheme. For example, I have this GSWV scheme: Fuchun Guo, Willy Susilo, Duncan Wong, Vijay Varadharajan: CP-ABE with constant-size keys for ...
1
vote
1answer
127 views

Exponent operation over element of G

I found a definition of an exponent operation over the element of $\mathbb{G}$ in this paper (page 4): $$ (g^a)^{\% b} = g ^{a \text{ mod } b}$$ I couldn't understand the rest of the paper (Decrypt ...
0
votes
3answers
613 views

What is the time requirement for pairing computation and modular exponentiation?

I want to design a cryptographic protocol for encrypted search without pairing. I have seen some papers for protocols without pairing. How would I compare pairing computation and modular operations?
-1
votes
1answer
67 views

Security for secret key of server in Identity-based Encryption

In the key set up phase, server generates Pub=s.P, where s is the secret key.Then , it gives clients Pub,P as public parameters and pairing descriptions. Is it possible for clients to pre-compute r.P ...
2
votes
0answers
50 views

no speedup from preprocessing in blynn's PBC library [closed]

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to ...
1
vote
2answers
481 views

System parameters in identity-based encryption

In IBE schemes, the system parameters are $(q, \mathbb{G}, F, \hat{e}, P, Q, T, H_1)$. I don't know $\hat{e}$. For example, in type A pairing… ...
1
vote
0answers
373 views

PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
3
votes
1answer
326 views

Generalization of the DL-assumption in bilinear group pair

When thinking about a pairing-based cryptographic scheme, I encountered the following problem. Let $e \colon G_1, G_2 \to G_T$ be a Type 3 pairing. Then: Given $P, zP \in G_1$ and $Q, zQ \in G_2$, ...
2
votes
1answer
690 views

How to calculate mapping in bilinear

I am trying to read a paper in cryptography. In key generation phase, paper give a definition for bilinear like G and Gt be two cyclic groups of prime order p $e: G * G \to G_t$. be a map with the ...
1
vote
1answer
264 views

the decryptNode function for leaf nodes in CP-ABE

Can someone please explain to me why decryptNode gives as result $e(g,g)^rq(0)$ for leaf nodes, I don't understand how they went from the second step to the third (here is the article: Ciphertext-...
2
votes
1answer
253 views

Bilinear map assumpion

Is there an assumption that says from a tag $k\cdot e(g,g_1)^{rx}$ ($k,r$ are secret) it is difficult to forge it with some x': $k\cdot e(g,g_1)^{rx'}$, as long as you cannot solve DL in $\mathbb{G}_1$...
4
votes
2answers
412 views

How to compare performances of lattice-based and pairing-based IBE schemes

I try to compare the performances (cost of Enc, Dec, ... size of keys, ciphertexts, ...) of IBE schemes using lattices (LWE hardness assumption) or pairing (Diffie-Hellman hardness assumption). I've ...
2
votes
1answer
372 views

Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve ...
2
votes
1answer
1k views

Concrete example of Weil Pairing

I am trying to find a concrete example of the Weil Pairing. What I have done until now is that I took $E=(x-1)(x-2)(x-3)$ over $F_5$. I took $E[2]=\{\infty,(1,0),(2,0),(3,0)\}$. I know that there ...
5
votes
0answers
106 views

Can cryptographically useful pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...
2
votes
0answers
64 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm $...
1
vote
0answers
61 views

Why the group order has to be prime for pairing-based cryptography [duplicate]

I'm trying to get into pairing-based cryptography and I don't see why the group order of the group G in the pairing function e:G*G-> G_t has to be a prime number. I don't find an argument why ...
0
votes
0answers
119 views

Sextic twist maps to q Eigenspace of Frobenius

Let $E(p)$ be a Barretto-Naehrig elliptic curve with r-torsion and embedding degree 12 and $E'$ a sextic twist with homomorphism $\psi$. How to show, that $E'$ has a unique r-torsion group $\psi$ ...
2
votes
0answers
207 views

Are the values of Tate and Ate pairing the same?

Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup. Do then the ...
1
vote
1answer
106 views

In bilinear pairings, is it possible to let someone be only able to decrypt ciphertexts in $G_1$ but not able to decrypt the ciphertexts in $G$?

For example, in Don Boneh et al.'s paper "Evaluating 2-DNF Formulas on Ciphertexts", they gave an encryption system that the cihpertext can be in either $G$ (when only additional homomorphic ...
1
vote
0answers
197 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...