Towards Ideal Self-bilinear Mapv

Bilinear maps (also called pairings) have been used for constructing various kinds of cryptographic primitives including (but not limited to) short signatures [4, 7], identity-based encryption [3, 5, 20], attribute-based encryption [2, 16, 19], and non-interactive zero-knowledge proof systems [17, 18]. In known instantiations of cryptographic bilinear maps based on eliptic curves, source and target groups are different groups, which may restrict applications of bilinear maps. Cheon and Lee [11] studied self-bilinear maps, which are bilinear maps whose source and target groups are identical. They showed huge potential of self-bilinear maps by showing that self-bilinear maps can be transformed into multilinear maps [8, 12], which give further more cryptographic applications including (but not limited to) multiparty non-interactive key exchange [8], broadcast encryption [8, 9], attribute-based encryption [6, 14], homomorphic signatures [10], and obfuscation [1, 13, 15]. However, they also showed a strong negative result on the existence of cryptographic self-bilinear maps. Namely, they showed that if there exists an efficiently computable self-bilinear map on a known order group, then the computational Diffie-Hellman (CDH) assumption does not hold on the group. This means that cryptographically useful self-bilinear maps do not exist on groups of known order. On the other hand, there is no negative result for self-bilinear maps on groups of unknown order. Indeed, Yamakawa et al. [21] gave a partial positive result for self-bilinear maps on unknown order groups. Namely, they constructed self-bilinear maps with auxiliary information, which is a weaker variant of self-bilinear maps based on indistinguishability obfuscation [1, 13]. Though they showed that they are sufficient for some applications of self-bilinear maps, they are not as useful as "ideal" self-bilinear maps, which do not need auxiliary information. In this talk, we first review the construction of self-bilinear maps with auxiliary information given by Yamakawa et al. Then we consider the possibility of constructing ideal self-bilinear maps.