Fully Verifiable Secure Delegation of Pairing Computation: Cryptanalysis and An Efficient Construction

We address the problem of secure and verifiable delegation of general pairing computation. We first analyze some recently proposed pairing delegation schemes and present several attacks on their security and/or verifiability properties. In particular, we show that none of these achieve the claimed security and verifiability properties simultaneously. We then provide a fully verifiable secure delegation scheme VerPair under one-malicious version of a two-untrusted-program model (OMTUP). VerPair not only significantly improves the efficiency of all the previous schemes, such as fully verifiable schemes of Chevallier-Mames et al. and Canard et al. by eliminating the impractical exponentiationand scalar-multiplication-consuming steps, but also offers for the first time the desired full verifiability property unlike other practical schemes. Furthermore, we give a more efficient and less memory consuming invocation of the subroutine Rand for VerPair by eliminating the requirement of offline computations of modular exponentiations and scalarmultiplications. In particular, Rand includes a fully verifiable partial delegation under the OMTUP assumption. The partial delegation of Rand distinguishes VerPair as a useful lightweight delegation scheme when the delegator is resource-constrained (e.g. RFID tags, smart cards or sensor nodes).