Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [pairings]

Pairing-based cryptography uses bilinear maps to create a gap group that allows efficient constructions of certain primitives.

Pairing-based cryptography (PBC) uses bilinear maps (typically on elliptic curves) to create a group where the DDH assumption is easy while CDH and DL remains hard: a "gap" group.

Among the applications of PBC are different functional cryptography such as identity-based encryption and attribute-based encryption, short signatures, verifiable random functions, and non-interactive zero knowledge proofs.

271 questions
7
votes
1 answer

Useful pairings for cryptography

I've recently looked a bit at pairing based cryptography and I was wondering what properties the groups involved should have in order to be useful for cryptographic purposes? Has anything more exact been formulated? As an example, we could just take…
del
  • 173
  • 3
5
votes
1 answer

Pairing-friendly curve whose group order is a safe prime

Are there any pairing-friendly curves whose group order is a safe prime? That is: the order of the group is $2q + 1$ for some prime number $q$. Or, is it impossible to have such groups?
Sean
  • 99
  • 9
5
votes
1 answer

Why pairing based crypto is suitable for some particular cryptographic primitives?

Why pairing based crypto is being widely used in some special crypto primitives as ID based crypto and variations of standard signatures? I mean taking as deep as possible what makes it suitable for that schemes while other schemes do not feet?
curious
  • 6,160
  • 6
  • 32
  • 45
5
votes
2 answers

Advantages of bilinear map

Consider the pairing $e: G_1*G_2 \to G_t$. Why we are mapping element from group $G_1$ and group $G_2$ to an element in $G_t$. How are they used in cryptography? What advantages do they provide?
Ravi
  • 205
  • 4
  • 9
4
votes
1 answer

What are the BLS12-381 settings?

I can't find the exact type and settings for the BLS12-381 curve. Is this type-3 in Symmetric XDH settings ?
shumy
  • 418
  • 3
  • 10
4
votes
1 answer

Order of twisted curve in pairings

We are doing optimal Ate pairings using a Barreto-Naehrig curve, and I am trying to make sure that an observation I made generalizes. We define $E$ as $y^2 = x^3 + 3$ and use the tower of extensions \begin{equation}\begin{split} …
Bob Wall
  • 434
  • 3
  • 12
3
votes
1 answer

Bilinear Map over group of unknown order

Is it possible to build a bilinear map where the underlying group is of unknown order? To maintain context, the original question appears below. As per poncho's excellent answer, my original idea is infeasible: Is it possible to build a bilinear…
user2900219
  • 31
  • 3
3
votes
1 answer

Order of target group in bilinear pairing

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers. Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ respectively, and $a$ is a random integer. What is the…
Majid
  • 69
  • 4
3
votes
0 answers

Are the values of Tate and Ate pairing the same?

Assume we have a Baretto Naehrig curve over $GF(p)$ and a field extension $GF(p^{12})$ given by a minimum polynomial. Let $G \in GF(p)$ and $Q \in GF(p^{12})$ from the trace 0 subgroup. Do then the Reduced Tate and Ate pairings produce the same…
cryptostase
  • 31
  • 1
3
votes
2 answers

Pairing Field size as security parameter

I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite field $F_{q^k}$. l is the order of these three…
Horst Lemke
  • 295
  • 1
  • 7
2
votes
1 answer

Exponentiation In PBC library

I need to compute a function $h^l$, where h is an element of G2 and l is a rational number. How can this be done using the PBC library? I have converted the h to an element in G2 As far as I have seen, for exponentiation, PBC has two functions…
Ajoy
  • 157
  • 9
2
votes
2 answers

DDH and pairings are not contradictory in RingCT 2.0?

As I know DDH assumption and bilinear pairings are contradictory, but I see this in a paper, RingCT 2.0. How could this be ok? Linkable ring signature will be attacked by bilinear pairings.
p1gd0g
  • 278
  • 1
  • 9
2
votes
1 answer

Multilinear Pairing in Cryptography

I want to create 2 Bilinear Pairing $e_1$,$e_2$ such that $$e_1:G_0 \times G_0 \rightarrow G_1$$ $$e_2:G_1 \times G_1 \rightarrow G_T$$ and use this to encrypt a message $M$ in the form $$M e_2(e_1(g,g),e_1(g,g))^{xy}$$ To decrypt the message,…
Azharul Islam
  • 85
  • 8
2
votes
0 answers

no speedup from preprocessing in blynn's PBC library

I am implementing some pairing-based cryptography protocol using blynn's PBC library. I am only at the beginning and I wanted to confirm that preprocessing does increase the speed. However I seem to measure only a very tiny speed up. Question: Could…
Cédric Van Rompay
  • 771
  • 5
  • 21
2
votes
1 answer

Concrete example of Weil Pairing

I am trying to find a concrete example of the Weil Pairing. What I have done until now is that I took $E=(x-1)(x-2)(x-3)$ over $F_5$. I took $E[2]=\{\infty,(1,0),(2,0),(3,0)\}$. I know that there exist a rational function f such…
user28082
  • 173
  • 7
1
2 3