$e:G_1 \times G_1 \rightarrow G_2$, where $g$ is a generator of $G_1$. $\text{H}: \lbrace 0,1\rbrace ^* \rightarrow G_1$.
Is $e(\text{H}(D)g^a,g) == e(\text{H}(D)g,g)^a$ ? where $D$ is a string
Asked
Active
Viewed 63 times
0
-
Does this answer your question? Does the following linear equation hold in bilinear pairings? – Patriot Feb 02 '21 at 05:28
-
does it means it holds? i couldnt follow the linked question. could you please explain? – Rabindra Moirangthem Feb 02 '21 at 05:48
1 Answers
2
Does the following equation hold in bilinear pairings?
No, not in general.
$g$ is posited to be a generator, and so (for any fixed $D$), we have $H(D) = g^b$, for some integer $b$ (which is hard to compute, but we're not going to have to compute it).
So, we have $e(H(D)g^a, g) = e(g^{a+b}, g)$.
If we move the $a$ exponent out, we then get $e(g^{1 + b/a}, g) = e( g \cdot g^{b/a}, g)^a$
Doing the same thing one the other side, we would get $e(H(D)g, g)^a = e(g \cdot g^b, g)^a$
It should be clear that these two terms are not (in general) identical.
poncho
- 147,019
- 11
- 229
- 360
-
$e(\text{H}(D)g^a,g) = e(\text{H}(D),g).e(g^a,g) = e(\text{H}(D),g).e(g,g)^a = e(\text{H}(D)g,g)^a$. Is this correct? – Rabindra Moirangthem Feb 03 '21 at 07:15
-
@RabindraMoirangthem: how'd you get from $e(H(D), g) \cdot e(g,g)^a$ to $e(H(D)g, g)^a$? How did $H(D)$ get managed to be raised to the power of $a$? – poncho Feb 03 '21 at 12:50
-
https://crypto.stackexchange.com/questions/19653/does-the-following-linear-equation-hold-in-bilinear-pairings what about this one? – Rabindra Moirangthem Feb 04 '21 at 04:37