I am trying to implement a scheme using charm crypto framework. For that I need to limit the order of Pairing groups. It was mentioned in docs that all pairing groups are of prime order p. Is there a way to set and retrieve the order of a group?
Here is some initialization code:
from charm.toolbox.pairinggroup import PairingGroup,ZR,G1,G2,GT,pair
group = PairingGroup('SS512') # Way to limit order of this Group.
g= group.random(G1)
You cannot arbitrarily limit the order of a group, because it is statically defined. Changing only the order would result in wrong math. See pairingcurves.py for the actual curve/group definitions.
Charm doesn't provide an API to randomly generate groups. You have to use some other means. You can define your own bilinear group for different types of pairings (A, A1, D, E, F, G) and load it through a file path:
group = PairingGroup('path/to/your.curve', param_file=True)
It is tricky to find a good curve, so this task shouldn't be taken lightly. Or you could use an existing curve that fits your needs, but you would need to fit its definition into the PBC framework syntax. Alternatively, you could try to use MIRACL or RELIC groups.
The bilinear group known as SS512 has an order of 159 bits, so you can easily generate a similarly sized group with jPBC like this:
TypeACurveGenerator acg = new TypeACurveGenerator(159, 512);
System.out.println(acg.generate().toString());
If this question is about using composite pairings in Charm, then this is certainly possible, but most (all?) schemes that use composite pairings work without change in prime-order pairing groups. Since Charm is primarily a prototyping framework, this is sort of acceptable.
If you want composite-order pairings, then you need to use type A1 pairings (in PBC terms). Here is a randomly generated 3 prime composite-order pairing with 512 bits:
type a1 p 1670989300461616676020115835196624302572015979741737622588414172392006868526486484884570321557721963197638289051694226860029659217040445686227725866093025893199423787713616626672757609704165197428442342008003828808450677009862027725351326816526944993760066091035498153554504093779461048411316013603195971067672308536313762529018467620342707812387949408799890849708954393542918305728285021157211449323969172048055050509532384121122664412498844071023691473088832866379 n 609850109657524334313910888757892081230662766329101322112559916931389368075360030979770190349533563210816893814486944109499875626657096965776542286895264924525337148800590009734583069235096787382643190513870010514033093799219718147938440443987936129109513171910765749472446749554547827887341610804086120827617630852669256397451995481876900661455455988613098850258742479395225659024921540568325346468601887608779215514427877416468125697992278858037843603317092287 n0 8505241857674726137023630400543607424307642763093227742803963199629609197431754602210402024133058838940680654387728383432014899362154746576168888879287087 n1 6728838950500080306008250663471535622833113558890962570274290389468902237095474435002792009761303551917673603722453122814539738669387524716830981925740419 n2 10656051345714616867334012480608522414320097962876120231224626211497062700168731928194215198773439101914013339645791513272716800476458903122389271111043579 l 2740
This was generated with the following code through jPBC:
TypeA1CurveGenerator a1 = new TypeA1CurveGenerator(3, 512);
System.out.println(a1.generate().toString());
Use at your own peril.