Hidden Pairings and Trapdoor DDH Groups

This paper suggests a new building block for cryptographic protocols and gives two instantiations of it. The concept is to generate two descriptions of the same group: a public description that allows a user to compute a restricted set of operations, and a private description that allows a greater set of operations to be computed. We will concentrate on the case where the public description allows a user to perform group operations, and the private description also allows a user to compute a bilinear pairing on the group. A user who has the private information can therefore solve decision Diffie-Hellman problems, and potentially also discrete logarithm problems. Some possible cryptographic applications of this idea are given. Both of our instantiations are based on elliptic curves. The first relies on the factoring assumption for hiding the pairing. The second relies on the hardness of solving a system of multivariate equations. The second method also gives rise to a practical trapdoor discrete logarithm system, thereby solving an important problem in cryptography. We hope that the paper will stimulate further research on these problems by both cryptographers and computational number theorists.