Families of genus 2 curves with small embedding degree

Abstract

Hyperelliptic curves of small genus have the advantage of providing a group of com- parable size as that of elliptic curves, while working over a field of smaller size. Pairing-friendly hyperelliptic curves are those whose order of the Jacobian is divisible by a large prime, whose em- bedding degree is small enough for computations to be feasible, and whose minimal embedding field is large enough for the discrete logarithm problem in it to be difficult. We give a sequence of Fq-isogeny classes for a family of Jacobians of genus two curves over Fq, for q = 2 m , and their corresponding small embedding degrees. We give examples of the parameters for such curves with embedding degree k < (logq) 2 , such as k = 8,13,16,23,26,37,46,52. For secure and efficient implementation of pairing-based cryptography on genus g curves over Fq, it is desirable that the ratio = g log2 q log2 N be approximately 1, where N is the order of the subgroup with embedding degree k. We show that for our family of curves, is often near 1 and never more than 2. We also give a sequence of Fq-isogeny classes for a family of Jacobians of genus 2 curves over Fq whose minimal embedding field is much smaller than the finite field indicated by the embedding degree k. That is, the extension degrees in this example differ by a factor of m, where q = 2 m , demonstrating that the embedding degree can be a far from accurate measure of security. As a result,