WeilMOV/

[utterances-bot]

Weil Pairing and the MOV attack on Elliptic Curve Cryptography – Risen Crypto – Mathematical Cryptography, zkSNARKs

https://risencrypto.github.io/WeilMOV/

[skaunov]

"The actual construction/computation of the Weil Pairing using Rational Functions is beyond the scope of this post." =(
This might be useful to move to the beginning. X)

Could you recommend an explainer better than Moonmath manual and https://crypto.stanford.edu/pbc/notes/elliptic/weil2.html?

[RisenCrypto]

Could you recommend an explainer better than Moonmath manual and https://crypto.stanford.edu/pbc/notes/elliptic/weil2.html?

The mathematics is non-trivial - I spent a lot of time & then gave up. It's way too difficult for anyone except an Algebraic Geometrist. I gave up after I read Ariel Gabizon mention somewhere that the mathematics behind pairings is not relevant for a Cryptographer & is only relevant to a Mathematician. He advised that Cryptographers should regard Pairings as a blackbox.

[skaunov]

Makes sense, thanks!

On 2023-11-17 16:57, RisenCrypto wrote: > Could you recommend an explainer better than Moonmath manual and > https://crypto.stanford.edu/pbc/notes/elliptic/weil2.html? The mathematics is non-trivial - I spent a lot of time & then gave up. It's way too difficult for anyone except an Algebraic Geometrist. I gave up after I read Ariel Gabizon mention somewhere that the mathematics behind pairings are not relevant for a Cryptographer & is only relevant to a Mathematician. He advised that Cryptographers should regard Pairings as a blackbox. -- Reply to this email directly, view it on GitHub [1], or unsubscribe [2]. You are receiving this because you commented.Message ID: ***@***.***>

Links: ------ [1] #9 (comment) [2] https://github.com/notifications/unsubscribe-auth/APXLOTY2GX7BLK2V6Y3SAHLYE5ULXAVCNFSM6AAAAAA7MZ2Q3KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJWGQ3TOMZSHE

[whoami730]

You should pick $n$ to be the order of the point $T$ and not the order of the group. As per [1], in most cases, $S$ would itself turn out to be $O$ in many cases (in the example mentioned in [1], it seems to be almost always the case), which kind of makes the attack take too long or fail. Even in [2], $n$ as the order of the point $T$ is picked, the gcd of $n$ and $m$ is computed as $d$, and then the point $S$ is computed as $(n/d) T$.

[1]
https://crypto.stackexchange.com/questions/114716/computing-random-point-in-mov-attack-example
[2]
Elliptic Curves - Number Theory and Cryptography, Lawrence C. Washington