128-bit Security Research Articles

On the Security Margin of TinyJAMBU with Refined Differential and Linear Cryptanalysis

This paper presents the first third-party security analysis of TinyJAMBU, which is one of 32 second-round candidates in NIST’s lightweight cryptography standardization process. TinyJAMBU adopts an NLFSR based keyed-permutation that computes only a single NAND gate as a non-linear component per round. The designers evaluated the minimum number of active AND gates, however such a counting method neglects the dependency between multiple AND gates. There also exist previous works considering such dependencies with stricter models, however those are known to be too slow. In this paper, we present a new model that provides a good balance of efficiency and accuracy by only taking into account the first-order correlation of AND gates that frequently occurs in TinyJAMBU. With the refined model, we show a 338-round differential with probability 2−62.68 that leads to a forgery attack breaking 64-bit security. This implies that the security margin of TinyJAMBU with respect to the number of unattacked rounds is approximately 12%. We also show a differential on full 384 rounds with probability 2−70.64, thus the security margin of full rounds with respect to the data complexity, namely the gap between the claimed security bits and the attack complexity, is less than 8 bits. Our attacks also point out structural weaknesses of the mode that essentially come from the minimal state size to be lightweight.

Generation of system-wide parameters for Falcon cryptosystem for 256, 384, 512 bits of security

Globally, the efforts of a significant number of crypto-theorists, mathematicians and cryptologists-practitioners are focused on the NIST PQC open competition. One of the main tasks of the competition consists in development and adoption of a post-quantum ES standard or standards. The finalists of the second stage of the NIST competition were three ES mechanisms – CRYSTALS-DILITHIUM, Falcon and Rainbow. In addition, three alternative candidates were identified that require more detailed research. In general, a comprehensive analysis of the finalists is an important task for cryptologists in the global cryptocommunity. Moreover, security, i.e. brining the cryptographic stability of two finalist candidates, to the ES standard – CRYSTALS-DILITHIUM and Falcon, is based on problems in the theory and practice of algebraic lattices. Studies show that among the ES schemes on lattices it differs slightly from other candidates and has prospects for the adoption as the Falcon algorithm standard. The main and dominant approach to the design of the Falcon ES mechanism is the use of the Fiat-Shamir transformation with interruptions. The sets of system-wide parameters that ensure resistance to all known and potential attacks should be found for the safe use of the Falcon ES. In the process of forming the requirements for ES within the competition, the NIST was interested only in sets of system-wide parameters up to 256 bits of classical security inclusive. However, according to the authors of this work, in the future it is advisable to provide at least 384 and 512 bits of security for classical cryptanalysis and at least 192 and 256 bits of security for quantum cryptanalysis. The article briefly considers the essence of the Falcon electronic signature (ES) algorithm. An analysis of possible attacks on the algorithm and the mechanisms of their implementation is also performed. The process of generating system-wide parameters for 256, 384, 512 stability bits is considered. Conclusions and recommendations are given. The objective of the work is the classification and initial analysis of known attacks on the ES Falcon cryptosystem, setting limits and developing practical algorithms for calculating (generating) system-wide parameters to provide not less than 256, 384 and 512 security bits for classical and not less than 128, 192 and 256 security bits for quantum cryptanalysis.

Processes and methods of selection of system-wide parameters of perspective algorithm of electronic signature based on algebraic lattices

An important feature of the transition and post-quantum period is the application of new mathematical methods to counteract quantum cryptanalysis. The world cryptographic community pays special attention to the open competition for the post-quantum standard of electronic signature. The problem is to prove the stability of new mathematical methods for the synthesis of transformations such as electronic signature, in particular with the use of algebraic lattices. The existing algorithms of electronic signature of the 2nd stage of the NIST competition are analyzed. Among the selected candidates for the EP 2 standard, 3 of the 3 algorithms are based on algebraic lattices, CRYSTALS-DILITHIUM and FALCON. The NIST has issued a statement saying that it is most likely that one of the algorithms will be chosen due to the same mathematical basis used in both algorithms. The main attacks on electronic signature algorithms based on the problem of learning with errors, as well as the parameters of the EP Dilithium algorithm, which affect the stability and complexity of transformations, are considered. Methods for generating system-wide parameters of stability levels of 512 bits of classical and 256 bits of quantum security, as well as the protection of the algorithm againstfrom attacks by third-party channels are considered. The dependence of the time of electronic signature production on the keys is analyzed. The results of calculations for the level of stability 512/256 are given, and also recommendations on the choice of system-wide parameters are given. The results of the 2nd stage of the NIST competition of post quantum cryptographic algorithms, as well as the prospects of standardization of transformations such as electronic signature at the 3rd stage are considered. Conclusions are made about the need for a more detailed study of attacks on algorithms based on the problem of learning with errors, as well as the importance of generating system-wide parameters of higher levels.

Fast computation of linear approximation over certain composition functions and applications to SNOW 2.0 and SNOW 3G

In this paper, we study the linear approximation of certain composition functions, with applications to SNOW 2.0 and SNOW 3G. We first propose an efficient algorithm to compute the linear approximation of certain composition functions with parallel operations, which has a linear-time complexity for any given mask tuple, and thus allows for a wide range of search for linear approximations. Naturally, we apply this algorithm to compute the linear approximations of the FSM of both SNOW 2.0 and SNOW 3G. For SNOW 2.0, we compute the linear approximation of the FSM for a wide range of linear masks, and obtain some results which enable us to slightly improve the data complexity of the known fast correlation attacks, by using multiple linear approximations and combining a small technique when applying the k-tree algorithm. For SNOW 3G, we make a careful search for the linear approximations of the FSM and obtain many mask tuples which yield high correlations. Using these linear approximations, we mount a fast correlation attack on SNOW 3G and recover the initial state of the LFSR with the total time complexity $$2^{222.33}$$ and memory complexity $$2^{221.74}$$ , given $$2^{220.74}$$ keystream words. Our attack does not pose a threat to the claimed 128-bit security of SNOW 3G.

Improved lattice-based CCA2-secure PKE in the standard model

Based on the identity-based encryption (IBE) from lattices by Agrawal et al. (Eurocrypt’10), Micciancio and Peikert (Eurocrypt’12) presented a CCA1-secure public-key encryption (PKE), which has the best known efficiency in the standard model and can be used to obtain a CCA2-secure PKE from lattices by using the generic BCHK transform (SIAM J Comput, 2006) with a cost of introducing extra overheads to both computation and storage for the use of other primitives such as signatures and commitments. In this paper, we propose a more efficient standard model CCA2-secure PKE from lattices by carefully combining a different message encoding (which encodes the message into the most significant bits of the LWE’s “secret term”) with several nice algebraic properties of the tag-based lattice trapdoor and the LWE problem (such as unique witness and additive homomorphism). Compared to the best known lattice-based CCA1-secure PKE in the standard model due to Micciancio and Peikert (Eurocrypt’12), we not only directly achieve the CCA2-security without using any generic transform (and thus do not use signatures or commitments), but also reduce the noise parameter roughly by a factor of 3. This improvement makes our CCA2-secure PKE more efficient in terms of both computation and storage. In particular, when encrypting a 256-bit (respectively, 512-bit) message at 128-bit (respectively, 256-bit) security, the ciphertext size of our CCA2-secure PKE is even 33%–44% (respectively, 36%–46%) smaller than that of their CCA1-secure PKE.

ACE: ARIA-CTR Encryption for Low-End Embedded Processors.

In this paper, we present the first optimized implementation of ARIA block cipher on low-end 8-bit Alf and Vegard’s RISC processor (AVR) microcontrollers. To achieve high-speed implementation, primitive operations, including rotation operation, a substitute layer, and a diffusion layer, are carefully optimized for the target low-end embedded processor. The proposed ARIA implementation supports the electronic codebook (ECB) and the counter (CTR) modes of operation. In particular, the CTR mode of operation is further optimized with the pre-computed table of two add-round-key, one substitute layer, and one diffusion layer operations. Finally, the proposed ARIA-CTR implementations on 8-bit AVR microcontrollers achieved 187.1, 216.8, and 246.6 clock cycles per byte for 128-bit, 192-bit, and 256-bit security levels, respectively. Compared with previous reference implementations, the execution timing is improved by 69.8%, 69.6%, and 69.5% for 128-bit, 192-bit, and 256-bit security levels, respectively.

Privacy-preserving approximate GWAS computation based on homomorphic encryption

BackgroundOne of three tasks in a secure genome analysis competition called iDASH 2018 was to develop a solution for privacy-preserving GWAS computation based on homomorphic encryption. The scenario is that a data holder encrypts a number of individual records, each of which consists of several phenotype and genotype data, and provide the encrypted data to an untrusted server. Then, the server performs a GWAS algorithm based on homomorphic encryption without the decryption key and outputs the result in encrypted state so that there is no information leakage on the sensitive data to the server.MethodsWe develop a privacy-preserving semi-parallel GWAS algorithm by applying an approximate homomorphic encryption scheme HEAAN. Fisher scoring and semi-parallel GWAS algorithms are modified to be efficiently computed over homomorphically encrypted data with several optimization methodologies; substitute matrix inversion by an adjoint matrix, avoid computing a superfluous matrix of super-large size, and transform the algorithm into an approximate version.ResultsOur modified semi-parallel GWAS algorithm based on homomorphic encryption which achieves 128-bit security takes 30–40 minutes for 245 samples containing 10,000–15,000 SNPs. Compared to the true p-value from the original semi-parallel GWAS algorithm, the F1 score of our p-value result is over 0.99.ConclusionsPrivacy-preserving semi-parallel GWAS computation can be efficiently done based on homomorphic encryption with sufficiently high accuracy compared to the semi-parallel GWAS computation in unencrypted state.

Fast Number Theoretic Transform for Ring-LWE on 8-bit AVR Embedded Processor.

In this paper, we optimized Number Theoretic Transform (NTT) and random sampling operations on low-end 8-bit AVR microcontrollers. We focused on the optimized modular multiplication with secure countermeasure (i.e., constant timing), which ensures high performance and prevents timing attack and simple power analysis. In particular, we presented combined Look-Up Table (LUT)-based fast reduction techniques in a regular fashion. This novel approach only requires two times of LUT access to perform the whole modular reduction routine. The implementation is carefully written in assembly language, which reduces the number of memory access and function call routines. With LUT-based optimization techniques, proposed NTT implementations outperform the previous best results by 9.0% and 14.6% for 128-bit security level and 256-bit security level, respectively. Furthermore, we adopted the most optimized AES software implementation to improve the performance of pseudo random number generation for random sampling operation. The encryption of AES-256 counter (CTR) mode used for random number generator requires only 3184 clock cycles for 128-bit data input, which is 9.5% faster than previous state-of-art results. Finally, proposed methods are applied to the whole process of Ring-LWE key scheduling and encryption operations, which require only 524,211 and 659,603 clock cycles for 128-bit security level, respectively. For the key generation of 256-bit security level, 1,325,171 and 1,775,475 clock cycles are required for H/W and S/W AES-based implementations, respectively. For the encryption of 256-bit security level, 1,430,601 and 2,042,474 clock cycles are required for H/W and S/W AES-based implementations, respectively.

Cocks–Pinch curves of embedding degrees five to eight and optimal ate pairing computation

Recent algorithmic improvements of discrete logarithm computation in special extension fields threaten the security of pairing-friendly curves used in practice. A possible answer to this delicate situation is to propose alternative curves that are immune to these attacks, without compromising the efficiency of the pairing computation too much. We follow this direction, and focus on embedding degrees 5 to 8; we extend the Cocks–Pinch algorithm to obtain pairing-friendly curves with an efficient ate pairing. We carefully select our curve parameters so as to thwart possible attacks by “special” or “tower” Number Field Sieve algorithms. We target a 128-bit security level, and back this security claim by time estimates for the DLP computation. We also compare the efficiency of the optimal ate pairing computation on these curves to $$k=12$$ curves (Barreto–Naehrig, Barreto–Lynn–Scott), $$k=16$$ curves (Kachisa–Schaefer–Scott) and $$k=1$$ curves (Chatterjee–Menezes–Rodriguez-Henriquez).

Lightweight Key Encapsulation Using LDPC Codes on FPGAs

In this paper, we present a lightweight hardware design for a recently proposed quantum-safe key encapsulation mechanism based on QC-LDPC codes called LEDAkem, which has been admitted as a round-2 candidate to the NIST post-quantum standardization project. Existing implementations focus on high speed while few of them take into account area or power efficiency, which are particularly decisive for low-cost or power constrained IoT applications. The solution we propose aims at maximizing the metric of area efficiency by rotating the QC-LDPC code representations amongst the block RAMs in digit level. Moreover, optimized parallelized computing techniques, lazy accumulation and block partition are exploited to improve key decapsulation in terms of area and timing efficiency. We show for instance that our area-optimized implementation for 128-bit security requires $6.82\times 10^5$ 6 . 82 × 10 5 cycles and $2.26\times 10^6$ 2 . 26 × 10 6 cycles to encapsulate and decapsulate a shared secret, respectively. The area-optimized design uses only 39 slices (3 percent of the available logic) and 809 slices (39 percent of the available logic) for key encapsulation and key decapsulation respectively, on a small-size low-end Xilinx Spartan-6 FPGA.

On the security of the modified Dual-ouroboros PKE using Gabidulin codes

Recently, Kim et al. proposed a modified Dual-Ouroboros public-key encryption ($${\textsf{PKE}}$$) using Gabidulin codes to overcome the limitation of having decryption failure in the original Dual-Ouroboros using low rank parity check codes. This modified Dual-Ouroboros $${\textsf{PKE}}$$ using Gabidulin codes is proved to be IND–CPA secure, with very compact public key size of 738 bytes achieving 128-bit security level. However, they did not specify on their choice of the secret key S used in their $${\textsf{PKE}}$$. In this paper, we analyze different possible choices for S in the modified Dual-Ouroboros $${\textsf{PKE}}$$ using Gabidulin codes. More specifically, we show that if S is invertible over $${\mathbb{F}}_{q^m}$$ without any restriction, then the decryption algorithm will fail. Furthermore, we show that Kim et al.’s proposal of the modified Dual-Ouroboros $${\textsf{PKE}}$$ using Gabidulin codes has secret key S over $${\mathbb{F}}_q$$ for its decryption algorithm to be correct. Then, we proposed two attacks: key recovery attack and plaintext recovery attack on their $${\textsf{PKE}}$$ with S over $${\mathbb{F}}_q$$. We are able to recover the secret key for all the proposed parameters within 235 seconds. Moreover, we show that the public key matrix in their proposal generates a subcode of Gabidulin code. As a consequence, we can apply the Frobenius weak attack on their proposal and recover the plaintext for all the proposed paramters within 0.614 second. Finally, we give a proposal for the modified Dual-Ouroboros $${\textsf{PKE}}$$ using Gabidulin codes such that it is correct and secure, by considering certain restrictions on S over $${\mathbb{F}}_{q^m}$$.

LoRa-Based Physical Layer Key Generation for Secure V2V/V2I Communications.

In recent years, Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication brings more and more attention from industry (e.g., Google and Uber) and government (e.g., United States Department of Transportation). These Vehicle-to-Everything (V2X) technologies are widely adopted in future autonomous vehicles. However, security issues have not been fully addressed in V2V and V2I systems, especially in key distribution and key management. The physical layer key generation, which exploits wireless channel reciprocity and randomness to generate secure keys, provides a feasible solution for secure V2V/V2I communication. It is lightweight, flexible, and dynamic. In this paper, the physical layer key generation is brought to the V2I and V2V scenarios. A LoRa-based physical key generation scheme is designed for securing V2V/V2I communications. The communication is based on Long Range (LoRa) protocol, which is able to measure Received Signal Strength Indicator (RSSI) in long-distance as consensus information to generate secure keys. The multi-bit quantization algorithm, with an improved Cascade key agreement protocol, generates secure binary bit keys. The proposed schemes improved the key generation rate, as well as to avoid information leakage during transmission. The proposed physical layer key generation scheme was implemented in a V2V/V2I network system prototype. The extensive experiments in V2I and V2V environments evaluate the efficiency of the proposed key generation scheme. The experiments in real outdoor environments have been conducted. Its key generation rate could exceed 10 bit/s on our V2V/V2I network system prototype and achieve 20 bit/s in some of our experiments. For binary key sequences, all of them pass the suite of statistical tests from National Institute of Standards and Technology (NIST).

Embedded Analog Physical Unclonable Function System to Extract Reliable and Unique Security Keys

Internet of Things (IoT) enabled devices have become more and more pervasive in our everyday lives. Examples include wearables transmitting and processing personal data and smart labels interacting with customers. Due to the sensitive data involved, these devices need to be protected against attackers. In this context, hardware-based security primitives such as Physical Unclonable Functions (PUFs) provide a powerful solution to secure interconnected devices. The main benefit of PUFs, in combination with traditional cryptographic methods, is that security keys are derived from the random intrinsic variations of the underlying core circuit. In this work, we present a holistic analog-based PUF evaluation platform, enabling direct access to a scalable design that can be customized to fit the application requirements in terms of the number of required keys and bit width. The proposed platform covers the full software and hardware implementations and allows for tracing the PUF response generation from the digital level back to the internal analog voltages that are directly involved in the response generation procedure. Our analysis is based on 30 fabricated PUF cores that we evaluated in terms of PUF security metrics and bit errors for various temperatures and biases. With an average reliability of 99.20% and a uniqueness of 48.84%, the proposed system shows values close to ideal.

Designing a model for predicting cyber-attack breaches in an untrusted environment by using linear regressing algorithm

Breaking down digital episode informational indexes is a significant technique for developing our comprehension of the advancement of the danger circumstance. This is a generally new research point, and numerous investigations stay to be finished. In this paper, we report a measurable investigation of a rupture occurrence informational index comparing to 12 years (2005–2017) of digital hacking exercises that incorporate malware assaults. We show that, as opposed to the discoveries revealed in the writing, both hacking rupture occurrence between appearance times and break sizes ought to be demonstrated by stochastic procedures, instead of by appropriations since they display autocorrelations. At that point, we propose specific stochastic procedure models to, separately, fit the between appearance times and the rupture sizes. We additionally show that these models can anticipate the between appearance times and the break sizes. So as to get further bits of knowledge into the advancement of hacking break episodes, we direct both subjective and quantitative pattern examinations on the informational index. We draw a lot of digital security bits of knowledge, including that the danger of digital hacks is without a doubt deteriorating regarding their recurrence, however not as far as the greatness of their harm.

Discrete modulation continuous-variable quantum key distribution based on quantum catalysis

Compared with discrete variable quantum key distribution (DVQKD), continuous variable (CV) QKD has high security bit rate and other advantages, which, however, are slightly insufficient in secure transmission distance. In addition, the application of quantum catalysis has significantly improved the performance of Gaussian modulated (GM) CVQKD, especially in secure transmission distance. Recently, the application of quantum catalysis has significantly improved the performance of GM-CVQKD. However, whether it can be used to improve the performance of discrete modulated (DM) CVQKD protocol is still ambiguous. Therefore, a scheme of DM CVQKD protocol based on quantum catalysis is proposed in this paper to further improve the performance of the proposed protocol in terms of secure key rate, secure transmission distance and maximum tolerable noise. Our results show that under the same parameters, when the transmittance <i>T</i> introduced by quantum catalysis is optimized, the proposed scheme can effectively further improve the performance of QKD system compared with the original four-state modulation CVQKD scheme. In particular, when the tolerable excess noise is 0.002, the use of quantum catalysis can break the safe communication distance of 300 km with a key rate of 10<sup>–8</sup> bits/pulse. However, if this noise is too large, the improvement in the effect of quantum catalysis on protocol performance will be restrained. In addition, in order to highlight the advantages of the use of quantum catalysis, the ultimate limit PLOB (Pirandola-Laurenza-Ottaviani-Banchi) bound of point-to-point quantum communication is given in this paper. The simulation results indicate that although neither the original scheme nor the proposed scheme can break the bound, compared with the former, the latter can be close to the boundary in long-distance transmission. These results provide theoretical basis for achieving the ultimate goal of global quantum security communication.

Modified pqsigRM: RM Code-Based Signature Scheme

We present a novel code-based signature scheme called modified pqsigRM. This scheme is based on a modified Reed–Muller (RM) code, which reduces the signing complexity and key size compared with existing code-based signature schemes. In fact, it strengthens pqsigRM submitted to NIST for post-quantum cryptography standardization. The proposed scheme has the advantage of the pqsigRM decoder and uses public codes that are more difficult to distinguish from random codes. We use $(U,U+V)$ -codes with the high-dimensional hull to overcome the disadvantages of code-based schemes. The proposed decoder samples from coset elements with small Hamming weight for any given syndrome and efficiently finds such an element. Using a modified RM code, the proposed signature scheme resists various known attacks on RM-code-based cryptography. For 128 bits of classical security, the signature size is 4096 bits, and the public key size is less than 1 MB.

Improved Ring LWR-Based Key Encapsulation Mechanism Using Cyclotomic Trinomials

In the field of post-quantum cryptography, lattice-based cryptography has received the most noticeable attention. Most lattice-based cryptographic schemes are constructed based on the polynomial ring R q = Z q [x]/f (x), using a cyclotomic polynomial f (x). Until now, the most preferred cyclotomic polynomials have been x n + 1, where n is a power of two, and x n + · · · + x + 1, where n + 1 is a prime. The former results in the smallest decryption error size, but the choice of degree is limited. On the other hand, the latter gives rise to the largest decryption error size, but the choice of degree is very flexible. In this paper, we use a new polynomial ring Rq = Zq/f (x) with a cyclotomic trinomial f (x) = x n - x n/2 + 1 as an intermediate that combines the advantages of the other rings. Since the degree n is chosen freely as n = 2 a 3 b for positive integers a and b, the choice of the degree n is moderate. Furthermore, since the error propagation is small in the middle of polynomial multiplication in the new ring, if the middle part is truncated and used, the decryption error size can be reduced. Based on these observations, we propose a new, practical key encapsulation mechanism (KEM) that is constructed over a ring with a cyclotomic trinomial. The security of our KEM is based on the hardness of ring learning-with-rounding (LWR) problems. With appropriate parameterization for the current 128-bit security model, we show that our KEM obtains shorter secret keys and ciphertexts, especially compared to the previous Ring-LWR-based KEM, Round5, with no error correction code. We then implement our KEM and compare its performance with that of several KEMs that were presented in the second round of the NIST PQC conference.

Algebraic Fault Analysis of UOV and Rainbow With the Leakage of Random Vinegar Values

A public-key cryptographic algorithm based on multivariate quadratic equations is one of promising post-quantum alternatives for current public-key cryptography. The security of multivariate quadratic schemes has been sufficiently analyzed mathematically, but few works have been devoted to implementation attacks. In this paper, we present algebraic fault analysis of two well-known multivariate quadratic schemes, UOV and Rainbow, which combines fault attacks with key recovery attacks using good keys. We focus on fault attacks which cause faults on random Vinegar values used in signing. Our fault models are divided into three cases according to the leakage types of the Vinegar values: reused, revealed and set to zero. We show that the equivalent key of UOV is completely recovered in polynomial time from $(m+1)$ , $n$ and $m$ signatures generated by the entire faulty Vinegar values in the three cases, respectively. Specifically, the equivalent key of UOV is completely recovered from 45, 103 and 44 signatures generated by 59 bytes of faulty Vinegar values in the three cases, respectively, at a 128-bit security level. The equivalent key of Rainbow is also recovered from 44, 79 and 43 signatures with 36 bytes of faulty Vinegar values in the three cases, respectively. This is the first result that leads to the full secret key recovery of UOV and Rainbow from the leakage of the Vinegar values. In the other cases, we show that complexities of the key recovery attacks on Rainbow and UOV are significantly weakened in terms of the number of faulty Vinegar values. Our attacks can be applied to Rainbow and LUOV selected to NIST Post-Quantum Cryptography Standardization Round 2. Countermeasures against our attacks are investigated.

Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Computing the optimal Ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.