3rd BIU Winter School on Cryptography:The Basics of Pairings - Dan Boneh
Why Cryptography Stack Exchange recommends it
Cryptography Stack Exchange users link it as a go-to introduction to pairings, both to answer questions on symmetric versus asymmetric pairings and to cite specific points about pairing degeneracy and curves over rings.
Recommended by 1 people across 1 different months, 2014 to 2017.
What it is
A 74-minute lecture by Dan Boneh at the 3rd Bar-Ilan University Winter School on Cryptography (2013), introducing bilinear pairings. It covers the basics of pairings over elliptic curves and how they are used in cryptography.
What people said
Recommends Edvard Fagerholm · 2014-10 · Cryptography Stack Exchange · on “Symmetric vs non-symmetric pairing based crypto”
This lecture by Dan Boneh should answer all your questions and more: [this video] ps. I saw you also had a question about NIZK proofs, so you should check out the full list of videos [LINK] which has almost 3 hours of lectures on Groth-Sahai proofs by Jens Groth which might interest you.
Cites les2004 · 2016-03 · Cryptography Stack Exchange · on “Non-Degeneracy of the Weil pairing”
In this YouTube video [this video] , Dan Boneh mentions that if both points are defined on the base field then the pairing is degenerate. Why is that? And specifically is this true if I use the Weil Pairing?
Cites cehptr · 2017-12 · Cryptography Stack Exchange · on “Pairings over elliptic curves on rings”
Looking at this presentation [this video] , Boneh says that elliptic curves could be defined over $\mathbb{Z}/n\mathbb{Z}$ and not necessarily over a prime field $\mathbb{F}_p$ and hence we could define pairings here as usual. Assume that $n = pq$ for $p,q$ primes. I agree with him when he says that the pairing is not computable because the elliptic curve group order is hard to find ($p,q$ are secret), hence we cannot apply Miller's algorithm. Very trivial idea: Keep $p,q$ still secret but publicly expose the order of the elliptic curve group (which can be found by the one that knows $p,q$). What would be the problem in this case?