Simplified pairing computation and security implications

Abstract

Abstract. Recent progress on pairing implementation has made certain pairings extremely simple and fast to compute. Hence, it is natural to examine if there are consequences for the security of pairing-based cryptography. This paper gives a method to compute eta pairings in a way which avoids the requirement for a final exponentiation. The method does not lead to any improvement in the speed of pairing implementation. However, it seems appropriate to re-evaluate the security of pairing based cryptography in light of these new ideas. A multivariate attack on the pairing inversion problem is proposed and analysed. Our findings support the belief that pairing inversion is a hard computational problem.

Efficient Computation for Pairing Based Cryptography: A State of the Art

“…The η pairing has already a simple final powering, but work done by Galbraith et al [38] (see [59,Section 5.4]) demonstrates that it can be eliminated entirely; the crucial step is the lack of normal denominator elimination, which is enabled by evaluation of additional line functions. Interestingly, the analysis of this approach demonstrates no negative security implication in terms of pairing inversion and so on.…”

The Diffie–Hellman problem and generalization of Verheul’s theorem

“…We note that the problem of inverting pairings is an area of active interest. See, for example, the papers [21], [22], [30], [51], [52], [53], or [54].…”

Aspects of Pairing Inversion

“…One can then compute eta or ate pairings on C(F p m ) efficiently. Galbraith,Ó hÉigeartaigh and Sheedy [11] showed that if one includes denominators then the final exponentiation is just a squaring. One can obtain suitable parameters with rather small values F p m .…”

“…Let P, Q ∈ C(F 83 ). Then the pairing of P with ψ(Q) (where ψ is the usual distortion map, see [7], [11]) can be computed as…”

“…It was shown by Galbraith,Ó hÉigeartaigh and Sheedy [11] and Granger et al [12] that some pairings can be computed without a final exponentiation (or with final exponentiation reduced to just a squaring). Hence, in these cases, the difficulty of pairing inversion depends entirely on the difficulty of inverting Miller's algorithm.…”