bilinear pairing on curves where discrete log is easy

Hi,

usually a bilinear pairing is defined on curves where the discrete
logarithm problem is hard.
Assume we have 2 groups G_1, G_2 of order q and a bilinear pairing e:
G_1 x G_1 -> G_2, then usually in cryptography given a value:
c= e(P,Q)^x (P, Q \in G_1, x \in Z_q)
it is hard to calculate x.

I wonder now if there are curves on which a bilinear pairing can be
defined but for which the calculation of x is easy.

I need this for the following problem:
Let P,Q \in G_1, x, m_1, m_2 \in Z_q and g \in G_2. Given the values
c_1= e(P,Q)^x * g^{m_1}
c_2= e(P,Q)^{-x} * g^{m_2}
the following holds, where x, m_1, m_2 are secrets:
1. It is hard to calculate m_1, m_2 and x seperatly
2. It is easy to calculate m_1+m_2

Is there any solution, maybe in using a special elliptic curve, where
the discrete logarithm problem is easy?

Thanks a lot in advance,
Zsuzsi
Received on Thu Sep 29 21:44:25 2005