On cryptographic protocols employing asymmetric pairings — The role of ΨΨ revisited

Asymmetric pairings e:G1×G2→GTe:G1×G2→GT for which an efficiently-computable isomorphism ψ:G2→G1ψ:G2→G1 is known are called Type 2 pairings; if such an isomorphism ψψ is not known then ee is called a Type 3 pairing. Many cryptographic protocols in the asymmetric setting rely on the existence of ψψ for their security reduction while some use it in the protocol itself. For these reasons, it is believed that some of these protocols cannot be implemented with Type 3 pairings, while for some the security reductions either cannot be transformed to the Type 3 setting or else require a stronger complexity assumption. Contrary to these widely held beliefs, we argue that Type 2 pairings are merely inefficient implementations of Type 3 pairings, and appear to offer no benefit for protocols based on asymmetric pairings from the point of view of functionality, security, and performance.