A Note on Subgroup Security in Pairing-Based Cryptography

Barreto~et al.\ (LATINCRYPT~2015) proposed a security notion, called subgroup security, for elliptic curves in pairing-based cryptography. They also claimed that, in some schemes, if an elliptic curve is subgroup-secure, the membership check, called full membership check, can be replaced by a cheaper membership check, called light membership check, which results in faster schemes than the original ones. However, they also noticed that some schemes will not maintain security if this replacement is done. It is unclear what schemes allow a secure replacement of the membership check. In this paper, we show a concrete example of insecurity in the sense of subgroup security in order to help developers understand what subgroup security is and what properties are actually preserved. In our conclusion, we recommend the developers to use the full membership check because it is a simple and general technique to securely implement schemes. If the developers use the light membership check for performance reasons, it is critical to carefully check that security is preserved.