A Profitable Sub-prime Loan: Obtaining the Advantages of Composite Order in Prime-Order Bilinear Groups

Lewko, Allison; Meiklejohn, Sarah

doi:10.1007/978-3-662-46447-2_17

Cited by 9 publications

(10 citation statements)

References 46 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our language, the pairing of Seo and Cheon is a (2, (r =`2, n =`+ 1,`)) pairing, i.e., ⇢ G`2 of dimension n =`+ 1. Recently, Lewko and Meiklejohn [19] simplified this construction, obtaining a (2, (r = 2`, n =`+ 1,`)) bilinear map generator. In [14] we also construct a (2, (r = 2`, n =`+ 1,`)) pairing achieving both properties (and which generalizes to any (k, (r = 2`, n =`+ 1,`)) with` k) , but using completely di↵erent techniques.…”

Section: Review Of Previous Results In Our Frameworkmentioning

confidence: 99%

“…In [14] we also construct a (2, (r = 2`, n =`+ 1,`)) pairing achieving both properties (and which generalizes to any (k, (r = 2`, n =`+ 1,`)) with` k) , but using completely di↵erent techniques. A direct comparison of [22], [19] with our pairing is not straightforward, since in fact they use dual vector spaces techniques and their pairing is not really symmetric.…”

Section: Review Of Previous Results In Our Frameworkmentioning

confidence: 99%

“…Freeman's work has spawned a number of follow-up results that investigate more general or more e cient conversions of this type [20,22,21,18,19]. We note that all of these works follow Freeman's interpretation of vectors, and even his possible interpretations of a vector multiplication.…”

Section: Introductionmentioning

confidence: 88%

“…We always assume that membership in is easy to decide. 2 In the case where n = r and = G r this is obviously the case, but otherwise we assume that the description of includes some auxiliary information which allows to test it (like in [22], [19] and our construction of Sec. B.2).…”

Section: Our Frameworkmentioning

confidence: 99%

See 3 more Smart Citations

Polynomial Spaces: A New Framework for Composite-to-Prime-Order Transformations

Herold

Hesse

Hofheinz

et al. 2014

Advances in Cryptology – CRYPTO 2014

View full text Add to dashboard Cite

At Eurocrypt 2010, Freeman presented a framework to convert cryptosystems based on compositeorder groups into ones that use prime-order groups. Such a transformation is interesting not only from a conceptual point of view, but also since for relevant parameters, operations in prime-order groups are faster than composite-order operations by an order of magnitude. Since Freeman's work, several other works have shown improvements, but also lower bounds on the e ciency of such conversions.In this work, we present a new framework for composite-to-prime-order conversions. Our framework is in the spirit of Freeman's work; however, we develop a di↵erent, "polynomial" view of his approach, and revisit several of his design decisions. This eventually leads to significant e ciency improvements, and enables us to circumvent previous lower bounds. Specifically, we show how to verify Groth-Sahai proofs in a prime-order environment (with a symmetric pairing) almost twice as e ciently as the state of the art.We also show that our new conversions are optimal in a very broad sense. Besides, our conversions also apply in settings with a multilinear map, and can be instantiated from a variety of computational assumptions (including, e.g., the k-linear assumption).

show abstract

Section: Review Of Previous Results In Our Frameworkmentioning

confidence: 99%

Section: Review Of Previous Results In Our Frameworkmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 88%

Section: Our Frameworkmentioning

confidence: 99%

See 2 more Smart Citations

Polynomial Spaces: A New Framework for Composite-to-Prime-Order Transformations

Herold

Hesse

Hofheinz

et al. 2014

Advances in Cryptology – CRYPTO 2014

View full text Add to dashboard Cite

show abstract

“…Subgroup hiding is a computational assumption that requires that, if G (respectively H) decomposes into two subgroups, then distinguishing between a random element of the full group and a random element of one of the subgroups should be hard. (This is actually the specific simple case of subgroup hiding originally introduced by Boneh, Goh, and Nissim [12]; more general definitions exist as well [31,30]. )…”

Section: Bilinear Groupsmentioning

confidence: 99%

Déjà Q: Using Dual Systems to Revisit q-Type Assumptions

Chase

Meiklejohn

2014

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

After more than a decade of usage, bilinear groups have established their place in the cryptographic canon by enabling the construction of many advanced cryptographic primitives. Unfortunately, this explosion in functionality has been accompanied by an analogous growth in the complexity of the assumptions used to prove security. Many of these assumptions have been gathered under the umbrella of the "uber-assumption," yet certain classes of these assumptions -namely, q-type assumptions -are stronger and require larger parameter sizes than their static counterparts.In this paper, we show that in certain bilinear groups, many classes of q-type assumptions are in fact implied by subgroup hiding (a well-established, static assumption). Our main tool in this endeavor is the dual-system technique, as introduced by Waters in 2009. As a case study, we first show that in composite-order groups, we can prove the security of the Dodis-Yampolskiy PRF based solely on subgroup hiding and allow for a domain of arbitrary size (the original proof only allowed a logarithmically-sized domain). We then turn our attention to classes of q-type assumptions and show that they are implied -when instantiated in appropriate groups -solely by subgroup hiding. These classes are quite general and include assumptions such as q-SDH. Concretely, our result implies that every construction relying on such assumptions for security (e.g., Boneh-Boyen signatures) can, when instantiated in appropriate composite-order bilinear groups, be proved secure under subgroup hiding instead.

show abstract

Refined Shacham–Waters ring signature scheme in Seo–Cheon framework

Das¹,

Rangasamy²,

Kabaleeshwaran

2016

Security Comm Networks

View full text Add to dashboard Cite

Composite order bilinear groups have some elegant structural characteristics that are useful in constructing advanced cryptographic schemes. However, they are computationally less efficient than their prime order counterparts thereby making them impractical. Thus, instantiating cryptographic schemes based on composite order bilinear groups in prime order setting while preserving all the structural properties has become an attractive area of research. Freeman identified two main properties, namely, projecting and cancelling that are useful in such conversions. Seo and Cheon constructed an asymmetric bilinear-group generator that is both projecting and cancelling in the prime order setting. Nonetheless, for this special generator, they could not find any useful cryptographic application. In this work, we instantiate Shacham-Waters ring signature scheme in the prime order setting. We emphasize that the converted scheme is instantiated in asymmetric setting. It is both elegant and efficient. Interestingly, with this conversion, we present the first cryptographic scheme based on the Seo-Cheon asymmetric bilinear-group generator. We also observe that the Seo-Cheon definition of translating needs to be more specific, otherwise computational Deffie-Hellman problem becomes easy in general. We comment on standard ways for making the converted scheme more efficient in terms of computation and signature length. the subgroup decision assumption and unforgeabilty under computational Diffie-Hellman (CDH) assumption in subgroup of order p. Boyen [10] also constructs a ring signature. But this scheme is set in a public-coin common random string model, without a trusted authority. This scheme uses a non-standard assumption for its security.* Tate pairing computation at 128-bit security level on BN-curves [12].The element size of G is 3072 bits.The element size of G is 512 bits and element size of H is 1024 bits.Security Comm. Networks (2016)

show abstract

A Profitable Sub-prime Loan: Obtaining the Advantages of Composite Order in Prime-Order Bilinear Groups

Cited by 9 publications

References 46 publications

Polynomial Spaces: A New Framework for Composite-to-Prime-Order Transformations

Polynomial Spaces: A New Framework for Composite-to-Prime-Order Transformations

Déjà Q: Using Dual Systems to Revisit q-Type Assumptions

Refined Shacham–Waters ring signature scheme in Seo–Cheon framework

Contact Info

Product

Resources

About