Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [bilinear-pairing]

A bilinear pairing is a function $e$ that takes two arguments and returns a single value. Arguments and return values belong to (possibly distinct) groups with inputs written additively and outputs written multiplicatively. The function is linear in both arguments so that $e(a+b,c)=e(a,c)e(b,c)$ and $e(a,c+d)=e(a,c)e(a,d)$.

A bilinear pairing is a function $e$ that takes two arguments and returns a single value. Arguments and return values belong to (possibly distinct) groups with inputs written additively and outputs written multiplicatively. The function is linear in both arguments so that $e(a+b,c)=e(a,c)e(b,c)$ and $e(a,c+d)=e(a,c)e(a,d)$. An example is the Weil pairing for elliptic curves.

20 questions
6
votes
1 answer

Will a semi-hyperelliptic pairing be used in real-world cryptography if it is faster than state-of-the-art elliptic pairings?

Let $\mathbb{G}_1$, $\mathbb{G}_2$, $\mathbb{G}_T$ stand for three groups of the same large prime order $r$. I invented a pairing $e\!: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$ (with embedding degree $k \in \mathbb{N}$) such that…
Dimitri Koshelev
  • 495
  • 2
  • 8
4
votes
1 answer

Elliptic curve bilinear pairing parameters for 80-bit security level

I am reading a paper based on elliptic curve bilinear pairing groups. The author has defined the size of private key, public key etc in terms of $|\mathbb{G}_1|, |\mathbb{G}_2|$ and $|\mathbb{G}_T|$. For 80-bit security level, what are the sizes of…
Shweta Aggrawal
  • 309
  • 1
  • 6
3
votes
0 answers

pairings and clifford algebra connection

Pairing notation seems to suggest that bilinear pairings could be related to Clifford Algebra (ie: Geometric Algebra); and we only have an odd choice of notation that hides this fact. For example, if EC groups $G_1$ and $G_2$ are akin to vectors,…
Rob
  • 349
  • 1
  • 13
3
votes
1 answer

Strong Diffie Hellman in bilinear groups

The $n$-strong Diffie Hellman assumption state that given the subset $\{g, g^s,\cdots,g^{s^n}\} \subseteq \mathbb{G}$ in a cyclic group $\mathbb{G}$ of prime order $p$, a PPT algorithm cannot output $g^{\frac{1}{s+\alpha}}$ for any $\alpha \in…
Mathdropout
  • 310
  • 1
  • 7
3
votes
0 answers

Decisional Diffie-Hellman Assumption on Pairing Friendly Curves

It is known that the Decision Diffie-Hellman (DDH) problem can be easily solved over groups on pairing friendly curves (that is: one can use pairing to tell if $g^x$ and $g^y$ and $g^z$ forms a DH tuple such that $z = x*y$). What about the…
Sean
  • 109
  • 9
3
votes
1 answer

Is this pairing-based signature scheme secure?

There are a number of signature schemes on small domains based on bilinear pairings which do not use random oracles. Examples are the Boneh-Boyen schemes and an interesting one from Okamoto which allows for blind, and partially blind…
user82867
  • 366
  • 1
  • 5
3
votes
1 answer

Weaknesses in pairing crypto with BN curves

Are there any known weaknesses in Barreto-Naehrig Curves (e.g. BN P256) ?
Rainer Urian
  • 31
  • 2
3
votes
2 answers

For an asymmetric bilinear pairing, can I get $g_2^t$ from $g_1^t$?

Let $e:G_1\times G_2\to G_t$ be an asymmetric bilinear pairing, $g_1$ be a generator of $G_1$ and $g_2$ be a generator of $G_2$. Can we compute $g_2^t$ from $g_1^t$ when $t$ is unknown?
XM-003
  • 31
  • 1
2
votes
1 answer

Properties of the bilinear pairing groups?

I stumbled across this correctness of a scheme: $e(g^r, H(id)^x) = e(g^x, H(id))^r = e(g^x, H(id))^r$ and have a hard time following the properties of the bilinear pairing. Does anyone know the "rules" for such pairings or where to read about…
Rory
  • 353
  • 2
  • 12
2
votes
1 answer

What is a function on a Line or a Curve?

I am reading up on Pairings using Elliptic curves & all the texts talk about functions on a Curve. I am finding it difficult to even figure out what they mean by "function on a curve" or "function on a line" The equation of a line or a curve itself…
user93353
  • 2,348
  • 3
  • 28
  • 49
2
votes
1 answer

What's the difference between Optimal ate pairing and R-ate pairing?

I compare the algorithm description of Optimal ate pairing and R-ate pairing, it turns out to me that the formulas are the same. So I'm a little confused, what's the difference between them? or is it just I misunderstand? Thanks very much. ref:…
jessica Hu
  • 21
  • 2
2
votes
0 answers

Cryptographic invariant maps

In [BGK+18] in section 4, Boneh et al. write that: For any choice of ideal classes $\mathfrak{a}_1,\dots,\mathfrak{a}_n,\mathfrak{a}_1',\dots,\mathfrak{a}_n'$ in ${Cl}(\mathcal{O})$, the abelian varieties \begin{align} (\mathfrak{a}_1 \star E)…
jvdh
  • 173
  • 6
2
votes
0 answers

If $e(aP, bP) = e(P, P)^{ab}$ then how can we solve $e(P^a, P^b)$?

I'm a bit confused regarding the bilinear pairing operation. Let's say I have a Public key of a receiver $P_r = P^x$ and I want to create a symmetric key using KEM with a pairing operation. If I chose $R = rP$ and compute $V = (Pr, P)^r $which…
Alia
  • 51
  • 6
1
vote
1 answer

Proof of knowledge of constant discrete log in the bilinear setting

Consider a pairing $\mathbb{e}: \mathbb{G}_1\times \mathbb{G}_2\longrightarrow \mathbb{G}_T$ with generators $g_1$, $g_2$ for $\mathbb{G}_1$, $\mathbb{G}_2$ respectively. The groups $\mathbb{G}_1$, $\mathbb{G}_2$, $\mathbb{G}_T$ are of some prime…
Mathdropout
  • 310
  • 1
  • 7
1
vote
0 answers

Multiplication of pairings vs. exponentiation of the group elements

Assume that we have a pairing as $e:G_1\times G_2\rightarrow G_T$. such that $g_1$ and $g_2$ are the generator of $G_1$ and $G_2$ respectively. In a protocol I have $A=\prod_{i=1}^n e(H(i),pk_i)$ where $H(i)\in G_1$ and its discrete-logarithm is…
A.Solei
  • 415
  • 2
  • 11
1
2