Hidden pairings and trapdoor DDH groups

Abstract

This paper suggests a new building block for cryptographic protocols and gives two instantiations of it. The concept is to generate two descriptions of the same group: a public description that allows a user to perform group operations, and a private description that allows a user to also compute a bilinear pairing on the group. A user who has the private information can therefore solve decisional Diffie-Hellman (DDK) problems, and potentially also discrete logarithm problems. Some cryptographic applications of this idea are given. Both instantiations are based on elliptic curves. The first relies on the factoring assumption for hiding the pairing. The second relies on the difficulty of solving a system of multivariate equations. The second method also potentially gives rise to a practical trapdoor discrete logarithm system. © Springer-Verlag Berlin Heidelberg 2006.