Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

62 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
96 views

Can cryptographically useful pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite ...
4
votes
0answers
209 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
3
votes
0answers
51 views

Are all MNT curves assumed to hold XDH?

For one of my projects, I need a pairing group which holds the External co-Diffie-Hellman assumption. I am trying to implement it using Charm crypto python modules which provides support for MNT ...
3
votes
0answers
96 views

New Pairing Friendly Curves for SM9

A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9 (Pay-Walled)" SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-...
3
votes
0answers
45 views

If curve bn256/bls12 support the isomorphism from $G_2$ to $G_1$?

Is bn256 or bls12 a type-2 pairing-friendly curve? As Dan Boneh said here While in many pairing instantiations this ψ exists naturally, in some instantiations it does not. However I can not find ...
3
votes
0answers
71 views

Is there a bilinear map on a non abelian group or non cyclic group?

I've recently been studying a pairing map on cryptography. In usual definition, a pairing map is always defined on the cyclic group G. Is it possible to construct a bilinear map on a non-abelian group ...
3
votes
0answers
99 views

Pairings over elliptic curves on rings

Looking at this presentation, Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings ...
3
votes
0answers
199 views

Prime extension field encoding ASN.1

ASN.1 encoding for elliptic curve cryptography is recommended by Certicom, as explained at a related question, covering curves over prime fields and binary extension fields. I'm looking for known ...
3
votes
0answers
264 views

TypeA pairing, elliptic curves in pairing based cryptography

I am beginner to pairing-based cryptography. After downloading jpbc library, curve parameters files are seen as properties file. For example, for type A curve, following parameters are given. type a ...
3
votes
0answers
94 views

Why does the new encryption scheme proposed by authors stop an adversary from guessing the subspace of the secret key?

In this paper, the authors construct an encryption scheme that is supposed to be resilient to tampering and leaking (as opposed to just leaking). Specifically this scheme: If you look at the ...
2
votes
0answers
39 views

Groth-Sahai Proof of multi-exponentiation

I want to create a NIZK proof of a multi-exponentiation via Groth-Sahai proofs. In the lectures of Jens Groth in a winter school of Bar-Ilan University, he shows a way to transform multi-...
2
votes
0answers
49 views

Security strength of JPBC Type A curve compared to SecP curve

I recently encountered some problems when learning about the JPBC library. Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
2
votes
0answers
436 views

Functional signatures with ECDSA Verifier

Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...
2
votes
0answers
237 views

What pairings are used in PBC and charm-crypto with the proposed elliptic curves?

I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
2
votes
0answers
259 views

Frey-Rück Attack (FR-Reduction) - Tate Pairing

I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
2
votes
0answers
271 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
2
votes
0answers
55 views

How to use maps in the Boneh Gentry Waters encryption scheme?

I am reading the source of pbc_bce library which implements the Boneh Gentry Waters broadcast encryption scheme. In this paper the authors use for their ...
2
votes
0answers
243 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
0answers
61 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm $...
2
votes
0answers
203 views

Are the values of Tate and Ate pairing the same?

Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup. Do then the ...
2
votes
0answers
369 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...
2
votes
0answers
207 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
2
votes
0answers
145 views

Type 2 to Type 1 pairing transformation - why not considered?

How come that in various articles about pairings I never saw anybody mention that there is a possibility to turn Type 2 pairing into Type 1 by setting $e' : G_2 \times G_2 \rightarrow \mu, (P,Q) \...
2
votes
0answers
85 views

For $e(g, d) = c $, can we compute $d$, given others

Given $$e(g, d) = c $$ where, $e$ is bilinear pairing function chosen by the user/attacker, the values of $g$ and $c$ are known $g, d ∈ \mathbb{G}_1$ , $c$ depends upon the $e$ can we somehow ...
2
votes
0answers
142 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
1
vote
0answers
28 views

Fixed variable in Groth16

In the paper On the Size of Pairing-based Non-interactive Arguments by Jens Groth, it is always referred in the equations to satisfy that $a_0 = 1$ and the others $a_1, ..., a_m \in \mathbb{F}$. I am ...
1
vote
0answers
16 views

Is the k-sum attack efficient in bilinear pairing variants?

From the k-sum definition, the objective is to solve something like: $\sum_{i=1}^n c_i = v_1$ where $v_1$ is known. If we use Elliptic Curve Points ($C_i$ and $G$) we can define a bilinear pairing ...
1
vote
0answers
31 views

Pair-friendly elliptic curves vs non friendly

Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
1
vote
0answers
26 views

What to learn in order to understand Weil Divisors

My current role as a software developer is leading into areas of research in elliptic-curve-cryptography that keeps bringing me back to bilinear pairings. This includes BLS Signatures, CL Signatures ...
1
vote
0answers
113 views

How do pairings behave on G2/twist points off the prime order subgroup?

$\newcommand{\F}{\mathbb{F}}$ Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
1
vote
0answers
114 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
15 views

The multi-linear maps are prone to zeroizing attack. Can anyone explain how the zeroizing attack breaks the computational assumptions?

I read that many cryptographic schemes based on multi-linear mapping are not secure because the zero testing procedure and zero encoding help an adversary to reveal the secrets and because of it, many ...
1
vote
0answers
54 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
1
vote
0answers
44 views

Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?

BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
1
vote
0answers
54 views

Complexity lower bound in Uber-Assumption family

I try to wrap my head around calculating of complexity lower bound using Corollary 1 from The Uber-Assumption Family by X.Boyen (http://www.academia.edu/download/30698012/...
1
vote
0answers
44 views

Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?

Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
0answers
101 views

Certificate Master Public Key with Pairing

I am currently working on CipherText Policy Attribute Based Encryption (CP-ABE) scheme. If we see the scheme, we can notice that the Authority may generate a Master Public Key and a Master Private Key(...
1
vote
0answers
56 views

size of group points and parameters in pairing based cryptography

$$e:G_1\times G_1\rightarrow G_2$$ In symmetric pairing-based cryptography with groups$(G_1,G_2)$ of prime order $q$ and $a,b \in Z_q$Will the size of random generator $P$ from$ G_1$ and $a$ be same?...
1
vote
0answers
350 views

PBC library: group of composite order for pairing operation

How to generate composite order group using PBC library? With PBC library, element_init_G1(g,pairing) statement creates element $g$ for group of prime order. I want ...
1
vote
0answers
169 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...
1
vote
0answers
117 views

DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
1
vote
0answers
263 views

A question about elliptic curves and finite fields in bilinear pairings

Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ...
1
vote
0answers
239 views

Bilinear pairing

I am working on Efficient Construction of Pairings which are being realized by Miller's algorithm. In this algorithm the basic steps are point doubling and line function computation point addition ...
1
vote
0answers
151 views

Why does computing g^a * g^{-a} with the PBC library result in zero?

My example code is as follows: /* * Example 1 * 1) Calculate g^a * 2) calculate g^{-a} * 3) multiply g^a * g^{-a} * */ Note: here ...
1
vote
1answer
1k views

Variant of the Decisional Bilinear Diffie Hellman problem

I am working on a cryptographic scheme and I need to rely on the following problem, which I have nicknamed the "Hybrid Decisional Bilinear Diffie Hellman (hDBDH)" problem: Let $e: \mathbb G_1 \...
0
votes
0answers
26 views

Where can I find references to the theory behind PBC library?

I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
0
votes
0answers
12 views

what is the non_residue value of BN462

I found an algorithm to find the frobenius coeffs here. Here, the non_residue of BLS12-381 is -1, And non_residue of BLS12-377 is written -5. How can I find this value? And what is the non_residue ...
0
votes
0answers
24 views

How to estimate the computation overhead of ECDSA?

I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005, 9, and 4.4 ms respectively. I want to ...
0
votes
0answers
31 views

Can Pedersen commitment be used in pairing groups?

For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
0
votes
0answers
22 views

pairing teta function calculation

I am struggling with some pairing calculation techniques and i do not know how to approach them I would be glad if anyone can explain them in an easy way. For example i have these two formulas 1) ...