3

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers.

Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ respectively, and $a$ is a random integer. What is the output of $e(g_1^p, g_2^a)$? Is it equal to $(g_t)^{ap}$?

What is the order of the result? Is it equal to $pq^2$?

I know usually in the pairing cryptography the order of groups is set to a prime integer, but, i just want to know what happens if the order is a composite integer $p^2q^2$.

Majid
  • 69
  • 4
  • Do you know that such a pairing exists? – fkraiem Dec 19 '16 at 12:47
  • And while we're at it, you speak of the "embedding degree". I seem to have forgotten what it is; can you remind me? – fkraiem Dec 19 '16 at 12:51
  • I do not see a definition of the term "embedding degree" in that link... What I'm trying to get at is, you seem to have only a faint idea of what you are talking about, so I suggest you refer to a serious source, such as for example the book of Hoffstein-Pipher-Silverman. – fkraiem Dec 19 '16 at 14:16
  • Ah, found it, it's buried in the middle of a big wall of text.... It says "it’s the degree of the extension of $\mathrm{GF}(q)$ which lets us have a subgroup of $\mathrm{GF}(q^k)^*$ that’s isomorphic to $G_1$." That will do, so what do you not uderstand? – fkraiem Dec 19 '16 at 14:20
  • For your second question "what is the order of $e(aQ, pQ)$, here's a hint: what's $q \cdot e(aQ, pQ)$ ? – poncho Dec 19 '16 at 16:25
  • I guess that the order of $G_t$ is $p^2q^2$ and $e(g_1^a,g_2^p)^q=g_t^{apq}$. In other words it is equal to $g_{t'}^{a}$, where $g_{t'}$ is a generator of a subgroup with order $pq$. – Majid Dec 20 '16 at 08:01
  • Is it correct? I cant find any reference which explains what is the output of the pairing with such inputs. – Majid Dec 20 '16 at 08:12

1 Answers1

3

I find it. The output is $e(g_1^p,g_2^a)=(g_t)^{ap}$. https://eprint.iacr.org/2013/812.pdfenter image description here

Majid
  • 69
  • 4