sion of an extended abstract published in Proceedings of Asiacrypt 2010, Springer-Verlag, 2010. Available from the IACR Cryptology ePrint Archive as Report 2010/474. Beginning with the work of Groth and Sahai, there has been much interest in transforming pairing-based schemes in composite-order groups to equivalent ones in prime-order groups. A method for achieving such transformations has recently been proposed by Freeman, who identified two properties of pairings using composite-order groups -- "cancelling" and "projecting" -on which many schemes rely, and showed how either of these properties can be obtained using prime-order groups. In this paper, we give evidence for the existence of limits to such transformations. Specifically, we show that a pairing generated in a natural way from the Decision Linear assumption in primeorder groups can be simultaneously cancelling and projecting only with negligible probability. As evidence that these properties can be helpf...