14
votes
Accepted
in Bilinear pairings, what is the difference between Type 2 and Type 3?
Note that you do not have an efficiently computable homomorphism from $G_1$ to $G_2$, but in Type-2 you have an efficiently computable homomorphism $\psi: G_2 \rightarrow G_1$ and in Type-3 you do not ...
- 12.1k
14
votes
Accepted
Is pairing based cryptography ready for productive use?
Type-1 (symmetric pairings) are dead for curves over fields of small characteristic. Over prime fields of large prime characteristic they are not really dead, but as they only offer small embedding ...
- 12.1k
14
votes
Why do we use groups, rings and fields in cryptography?
Kindly, let me know what was the actual problem which leads us to use groups in cyptogrpahy?
Well, we use groups and other similar mathematical constructs because:
We found there are problems that ...
- 132k
13
votes
Accepted
Why "pairings on elliptic curve" are used?
Although the question is a bit broad, I think it's an interesting one.
Giving a bit of context helps with the explanations. In the 80's, many cryptographic primitives have been design, based on group ...
- 16.7k
12
votes
Accepted
Pairing on FourQ
The facts you mention regarding the embedding degree show that FourQ is not a pairing-friendly curve, and hence you cannot compute a pairing on it efficiently. Indeed, the representation of group ...
- 1,459
11
votes
Accepted
Are pairings still the most efficient implementation for identity and attribute-based encryption?
I am just going to answer regarding identity-based encryption (IBE): I don't know much about the situation for attribute-based encryption.
Also, I am just answering based on today's situation: recent ...
- 1,082
8
votes
Accepted
Given $g^a, g^b, g^c, g^{1/b}$, is it hard to distinguish $e(g, g)^{abc}$ from a random value?
Your problem seems to be at least as hard as the 2-weak Bilinear Diffie-Hellman Inversion Problem (2-wBDHI problem):
Given $g, g^x, g^{x^2}, g^y \in \mathbb G$, and $T \in \mathbb G_T$ to determine ...
- 4,832
8
votes
Do I need to prove this?
I purposefully did not look at the details of the change you are proposing because whatever the change is, the answer is a resounding YES. If you make any change to a cryptographic construction, then ...
- 26.9k
8
votes
Why do we use groups, rings and fields in cryptography?
Groups have properties which are useful for many cryptographic operations
When you multiply 2 numbers in a cryptographic operation you want the result of the multiplication also to be in the same set....
- 1,637
7
votes
Accepted
Multilinear Pairing in Cryptography
Pairings, or bilinear maps, have indeed found a great deal of applications in crypto; hence, researchers have soon pointed out that further "degrees" of linearity (trilinear maps, etc.) would provide ...
- 16.7k
7
votes
Accepted
How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?
Notation is basically a free choice of the author, as they describe functionally the same. And there is no fixed definition for this. However, common practice in mathematical publications is:
...
- 12.3k
7
votes
Accepted
BN-Curves for 256-bit symmetric security
A BN-curve over a 256-bit prime field $\mathbb{F}_p$ has, being an elliptic curve, a 256-bit group attached to it, say of order $N$. As the best known attacks take $\approx\sqrt{N}$ times, this gives ...
- 3,389
6
votes
Are Barreto-Naehrig Curves suitable for pairing-based cryptography?
You can, with the right parameter sizes (384-bit prime instead of the older 256-bit).
Pairings can be attacked in two fronts: the elliptic curve or the extension finite field. The security of the ...
- 6,109
6
votes
How does Boneh–Lynn–Shacham work?
BLS signatures work in any so called gap group, i.e., a group where the computational version of the Diffie-Hellman (DH) problem - the CDH - is hard, but the decisional version of the DH problem - the ...
- 12.1k
6
votes
Accepted
DDH and pairings are not contradictory in RingCT 2.0?
For the following explanation, let $e: \mathbb{G}_1 \times \mathbb{G}_2 \rightarrow \mathbb{G}_T$. It depends on the setting you are using whether DDH can hold or not. In the symmetric setting ($\...
- 1,293
6
votes
Accepted
Current situation of bilinear pairing protocols
That paper is misleading in several ways:
The DSA vs BB comparison: it is unfair because it compares DSA with the "full" BB scheme, which does not produce shorter signatures. The same BB ...
- 6,109
5
votes
Bilinear pairing arithmetic - cryptographic accumulators
This can be calculated by dividing $f(e,s)/(e_k+s)$ (assuming all $e_i$'s and $s$ are known to me) and raising $g$ to it.
First, if the prover knows $s$, it doesn't need to know the $e_i$'s to create ...
- 742
5
votes
Accepted
Pairings in Identity-based encryption vs. Attribute-based encryption
There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write ...
- 37.7k
5
votes
How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?
For all efficient pairings we are aware of and actually use in cryptography, the groups $G_1$ and $G_2$ are elliptic curve groups (which are traditionally additively written, i.e., additive groups). ...
- 12.1k
5
votes
Pairing - Is it possible to map two $r$-torsion points to a $r^2$-torsion point?
No, it is not possible.
By the definition of bilinearity, we have $e( kG, H ) = k \cdot e( G, H )$. If the order of $G$ is $r$ (that is, $rG = 0$, we have $e( rG, H ) = e( 0, H ) = r \cdot e(G, H)$. ...
- 132k
5
votes
Accepted
Can Curve25519 be used for pairing-based cryptography?
The embedding degree specifies how many times bigger the finite-field you map to is compared to the field the curve is defined over.
For example for BN(2,254) the degree is 12, mapping to a 3000 bit ...
- 24k
5
votes
Accepted
What does the number 256 in pairing curve BN256 indicate?
It's the size of the prime number of the underlying field in G1, G2 and GT.
In BN256, G1 is $E(\mathrm{GF}(p))$, G2 is a subgroup of $E(\mathrm{GF}(p^{12}))$ (or $E'(\mathrm{GF}(p^{2}))$ when using a ...
- 6,109
5
votes
Accepted
Is this pairing-based signature scheme secure?
The proposed digital signature scheme is not secure! More precisely, it is not existentially unforgeable under an adaptive chosen-message attack.
Let's consider the following efficient adversary $\...
4
votes
pairing-based schemes
Pairings in cryptography is a very important tool, the introduction of which has developed a new field, that is pairing-based cryptography.
After the independent pioneering work by Joux and by Sakai ...
- 81
4
votes
Accepted
Pairing Field size as security parameter
Thats a bit outdated as for your choice of setting (with $k=6$) the 170 bit will give you 1020 bit security in the subgroup of $F_{q^6}^*$.
In your case for embedding degree 6 I would at least take ...
- 12.1k
4
votes
How to compute accumulated values in bilinear map accumulators
In your setting this is assumed to be hard. It is exactly the task of producing a forgery for message $s$ of the weakly secure Boneh-Boyen signature scheme (Sec. 3.1) under public key $g^{e_1}$ (note ...
- 12.1k
4
votes
How to compare performances of lattice-based and pairing-based IBE schemes
It is very hard to give a concrete, "apples-to-apples" comparison of lattice-based and pairing-based IBE schemes. There are many reasons: the research surrounding concrete secure parameters for LWE ...
- 5,609
4
votes
Is the Discrete logarithm problem suitable for this pairing scheme?
First of all, let us simplify the equation by replacing things that the attacker can compute with known constants. We come up with:
$$a \cdot b^x = y$$
where the attacker knows $a$ (which is $e(g,h)...
- 132k
4
votes
Does pairings based cryptography inherently require a CRS/trusted setup?
No. For example, these pairing-based protocols don't require trusted setup:
BLS signatures;
tripartite Diffie-Hellman, as mentioned in Elias' answer;
some identity-based encryption schemes (when ...
- 417
4
votes
Accepted
Elliptic curves with pairings at 128-bit security in libpbc?
The security of pairing-based cryptography relies on the security of the elliptic curve (which is linked to the size of underlying finite field, or "base field") and of the finite extension field ...
- 6,109
Only top scored, non community-wiki answers of a minimum length are eligible