Re: bilinear pairing on curves where discrete log is easy

Hi,

>
> I think such curves are anomalous, but not supersingular, and hence
> probably not much use for bilinear pairings. For supersingular curves
> the group order should be p+1, not p.
So such curves won't work in my scenario, cause I need the bilinear
pairings?

As I described my problem:
Let P,Q \in G_1, x, m_1, m_2 \in Z_q and g \in G_2. Given the values
c_1= e(P,Q)^x * g^{m_1}
c_2= e(P,Q)^{-x} * g^{m_2}
the following holds, where x, m_1, m_2 are secrets:
1. It is hard to calculate m_1, m_2 and x seperatly
2. It is easy to calculate m_1+m_2

Maybe there is another kind of solutin, then using a weak curve (where
the discrete log problem is easy). Maybe there is a special value g \in
G_2 for which the discrete log of g^x can be easily evaluate, what do
you think?

Bye and thank you very much,
Zsuzsi
Received on Thu Sep 29 21:44:29 2005