Pairing-friendly Elliptic Curves Research Articles

Faster optimal ate pairings for cyclotomic sparse families of pairing-friendly elliptic curves with embedding degrees k = 5,7

Nowadays, pairing-based cryptography researchers are looking for new parameters for standard security levels against the new number field sieve tower number field sieve algorithm. Recently, they have suggested new parameters for well-studied pairing-friendly curves with odd embedding degrees five and seven resistant to this attack. In this paper, we define optimal ate pairing on curves using sparse families with embedding degrees five and seven. We also provide details to perform the miller loop and the final exponentiation using addition chain process. Our theoretical results costs indicate that these families of curves offer the best performance in the computation of the optimal ate pairing at the 128-bit security level compared to Cocks–Pinch curves of embedding degrees five and seven. The improvement is about [Formula: see text] and [Formula: see text] faster than the optimal ate pairing previously computed on Cocks–Pinch curves of embedding degrees five and seven, respectively.

Efficient Final Exponentiation for Cyclotomic Families of Pairing-Friendly Elliptic Curves with Any Prime Embedding Degrees

Efficient Final Exponentiation for Cyclotomic Families of Pairing-Friendly Elliptic Curves with Any Prime Embedding Degrees

Twisted Edwards Elliptic Curves for Zero-Knowledge Circuits

Circuit-based zero-knowledge proofs have arose as a solution to the implementation of privacy in blockchain applications, and to current scalability problems that blockchains suffer from. The most efficient circuit-based zero-knowledge proofs use a pairing-friendly elliptic curve to generate and validate proofs. In particular, the circuits are built connecting wires that carry elements from a large prime field, whose order is determined by the number of elements of the pairing-friendly elliptic curve. In this context, it is important to generate an inner curve using this field, because it allows to create circuits that can verify public-key cryptography primitives, such as digital signatures and encryption schemes. To this purpose, in this article, we present a deterministic algorithm for generating twisted Edwards elliptic curves defined over a given prime field. We also provide an algorithm for checking the resilience of this type of curve against most common security attacks. Additionally, we use our algorithms to generate Baby Jubjub, a curve that can be used to implement elliptic-curve cryptography in circuits that can be validated in the Ethereum blockchain.

Restrictions of Integer Parameters for Generating Attractive BLS Subfamilies of Pairing-Friendly Elliptic Curves with Specific Embedding Degrees

Pairings are widely used for innovative protocols such as ID-based encryption and group signature authentication. According to the recent works, the Barreto-Lynn-Scott (BLS) family of pairing-friendly elliptic curves is suggested for the pairings at the various security levels. One of the important facts is that the BLS family has fixed polynomial parameters of a field characteristic and group order in terms of an integer x_0. For practical pairing-based protocols, we have to carefully find x_0 which leads to efficient pairings, however, this search of x_0 is typically complicated. Thus, it is desired some convenient ways of finding x_0 which have advantageous for the pairings. For this reason, Costello et al. proposed simple restrictions for finding x_0 that generates the specific BLS subfamilies of curves with embedding degree k = 24 having one of the best field and curve constructions for the pairings. Since there are demands of such restrictions for the other cases of the embedding degrees, the authors extend their work and provide these for the cases of k = 2^m 3 and 3^n with arbitrary integers m, n>0 in this paper. The results will help to find new parameters which lead to one of the best performing pairings with the BLS family of curves with various k. The results also allow us to respond to change in the security levels of the pairings flexibly according to the progress in the security analyses in the future.

Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Computing the optimal Ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Fast Hashing to $${\mathbb {G}}_{2}$$ on Aurifeuillean Pairing-Friendly Elliptic Curves

In pairing-based cryptography, the computation of asymmetric pairings $$e: {\mathbb {G}}_{1}\times {\mathbb {G}}_{2}\longrightarrow {\mathbb {G}}_{T}$$ requires input points of prime order r. The process of getting those r-torsion point is known as hashing into $${\mathbb {G}}_{1}$$ or $${\mathbb {G}}_{2}$$ and is in general costly. Few recent works have considered the Scott et al.’s method and Fuentes et al.’s method for hashing on specific families of pairing-friendly curves. In this work, we apply those two methods on the recently discovered Scott–Guillevic Aurifeuillean curves with embedding degree $$k=6,9,15,18,27$$ and 54. The results obtained show that the Fuentes et al.’s method is at least twice faster than the Scott et al.’s method in terms of group operations. In addition, the computational cost of hashing into $${\mathbb {G}}_{2}$$ studied in this work is higher compared to the previous work done with BN curves, KSS curves and BLS curves at comparable embedding degrees.

TNFS resistant families of pairing-friendly elliptic curves

Recently there has been a significant progress on the tower number field sieve (TNFS) method, reducing the complexity of the discrete logarithm problem (DLP) in finite field extensions of composite degree. These new variants of the TNFS attacks have a major impact on pairing-based cryptography and particularly on the selection of the underlying elliptic curve groups and extension fields. In this paper we revise the criteria for selecting pairing-friendly elliptic curves considering these new TNFS attacks in finite extensions of composite embedding degree. Additionally we update the criteria for finite extensions of prime degree in order to meet today's security requirements.

Fast and simple constant-time hashing to the BLS12-381 elliptic curve

Pairing-friendly elliptic curves in the Barreto-Lynn-Scott family are seeing a resurgence in popularity because of the recent result of Kim and Barbulescu that improves attacks against other pairing-friendly curve families. One particular Barreto-Lynn-Scott curve, called BLS12-381, is the locus of significant development and deployment effort, especially in blockchain applications. This effort has sparked interest in using the BLS12-381 curve for BLS signatures, which requires hashing to one of the groups of the bilinear pairing defined by BLS12-381.While there is a substantial body of literature on the problem of hashing to elliptic curves, much of this work does not apply to Barreto-Lynn-Scott curves. Moreover, the work that does apply has the unfortunate property that fast implementations are complex, while simple implementations are slow.In this work, we address these issues. First, we show a straightforward way of adapting the “simplified SWU” map of Brier et al. to BLS12-381. Second, we describe optimizations to this map that both simplify its implementation and improve its performance; these optimizations may be of interest in other contexts. Third, we implement and evaluate. We find that our work yields constant-time hash functions that are simple to implement, yet perform within 9% of the fastest, non–constant-time alternatives, which require much more complex implementations.

Beta Weil pairing revisited

In this paper, we extend the $$\beta $$ -Weil pairing, initially introduced in the setting of ordinary elliptic curves with even embedding degree by Aranha et al. [2], to ordinary elliptic curves of any embedding degree. We also propose a new optimal pairing which is the product of some rational functions with the same Miller loop and having a simple final exponentiation. The new pairing is appropriated for using the multi-pairing technique for an efficient implementation. We focus our computation at high security level. Exploiting the fact that the $$\beta $$ -Weil pairing is suitable for parallel execution, we first show that calculating the extended $$\beta $$ -Weil pairing over pairing-friendly elliptic curves with embedding degree 27 is more efficient than calculating the optimal ate pairing. Finally we show that calculating our new pairing over Barreto–Lynn–Scott curves with embedding degree 12 (BLS12) and pairing-friendly elliptic curves with embedding degree 15 is more efficient than calculating the optimal ate pairing.

On Cycles of Pairing-Friendly Elliptic Curves

A cycle of elliptic curves is a list of elliptic curves over finite fields such that the number of points on one curve is equal to the size of the field of definition of the next, in a cyclic way. We study cycles of elliptic curves in which every curve is pairing-friendly. These have recently found notable applications in pairing-based cryptography, for instance, in improving the scalability of distributed ledger technologies. We construct a new cycle of length 4 consisting of MNT curves, and characterize all the possibilities for cycles consisting of MNT curves. We rule out cycles of length 2 for particular choices of small embedding degrees. We show that long cycles cannot be constructed from families of curves with the same complex multiplication discriminant, and that cycles of composite order elliptic curves cannot exist. We show that there are no cycles consisting of curves from only the Freeman or Barreto--Naehrig families.

Generating pairing-friendly elliptic curve parameters using sparse families

Abstract The majority of methods for constructing pairing-friendly elliptic curves are based on representing the curve parameters as polynomial families. There are three such types, namely complete, complete with variable discriminant and sparse families. In this paper, we present a method for constructing sparse families and produce examples of this type that have not previously appeared in the literature, for various embedding degrees. We provide numerical examples obtained by these sparse families, considering for the first time the effect of the recent progress on the tower number field sieve (TNFS) method for solving the discrete logarithm problem (DLP) in finite field extensions of composite degree.

Generating pairing-friendly elliptic curves with fixed embedding degrees

Generating pairing-friendly elliptic curves with fixed embedding degrees

Constructing Pairing-Friendly Elliptic Curves under Embedding Degree 1 for Securing Critical Infrastructures.

Information confidentiality is an essential requirement for cyber security in critical infrastructure. Identity-based cryptography, an increasingly popular branch of cryptography, is widely used to protect the information confidentiality in the critical infrastructure sector due to the ability to directly compute the user’s public key based on the user’s identity. However, computational requirements complicate the practical application of Identity-based cryptography. In order to improve the efficiency of identity-based cryptography, this paper presents an effective method to construct pairing-friendly elliptic curves with low hamming weight 4 under embedding degree 1. Based on the analysis of the Complex Multiplication(CM) method, the soundness of our method to calculate the characteristic of the finite field is proved. And then, three relative algorithms to construct pairing-friendly elliptic curve are put forward. 10 elliptic curves with low hamming weight 4 under 160 bits are presented to demonstrate the utility of our approach. Finally, the evaluation also indicates that it is more efficient to compute Tate pairing with our curves, than that of Bertoni et al.

Families of Pairing-Friendly Elliptic Curves from a Polynomial Modification of the Dupont-Enge-Morain Method

Families of Pairing-Friendly Elliptic Curves from a Polynomial Modification of the Dupont-Enge-Morain Method

Note on families of pairing-friendly elliptic curves with small embedding degree

Pairing-based cryptographic schemes require so-called pairing-friendly elliptic curves, which have special properties. The set of pairing-friendly elliptic curves that are generated by given polynomials form a complete family. Although a complete family with a $\rho$-value of 1 is the ideal case, there is only one such example that is known, this was given by Barreto and Naehrig. We prove that there are no ideal families with embedding degree 3, 4, or 6 and that many complete families with embedding degree 8 or 12 are nonideal, even if we chose noncyclotomic families.

Simple-Yet-Efficient Construction and Revocation of Group Signatures

Group signatures are typically used to authenticate the signer of message while preserving the privacy of the signer. Group signature should be minimized to reduce potential communication overhead. We propose a novel short group signature scheme that generates constant-size group public key and constant-size group signature. The scheme, using pairing-friendly elliptic curves, is efficient in construction. We give the security proof under XDH and ECDL hardness assumptions in the BMW model. Furthermore, we propose two group membership revocation methods which provide revocation information only to verifiers. One revocation method exposes partial private key of revoked users, which requires less revocation information. The other revocation method includes mixed private key information without revealing the real private keys of revoked users. This method is simple in revocation check.

Report on Pairing-based Cryptography.

This report summarizes study results on pairing-based cryptography. The main purpose of the study is to form NIST’s position on standardizing and recommending pairing-based cryptography schemes currently published in research literature and standardized in other standard bodies.The report reviews the mathematical background of pairings. This includes topics such as pairing-friendly elliptic curves and how to compute various pairings. It includes a brief introduction to existing identity-based encryption (IBE) schemes and other cryptographic schemes using pairing technology. The report provides a complete study of the current status of standard activities on pairing-based cryptographic schemes. It explores different application scenarios for pairing-based cryptography schemes. As an important aspect of adopting pairing-based schemes, the report also considers the challenges inherent in validation testing of cryptographic algorithms and modules.Based on the study, the report suggests an approach for including pairing-based cryptography schemes in the NIST cryptographic toolkit. The report also outlines several questions that will require further study if this approach is followed.

A new method of choosing primitive elements for Brezing–Weng families of pairing-friendly elliptic curves

Abstract In this paper we present a new method of choosing primitive elements for Brezing–Weng families of pairing-friendly elliptic curves with small rho-values, and we improve on previously known best rho-values of families [J. Cryptology 23 (2010), 224–280], [Lecture Notes in Comput. Sci. 5209, Springer (2008), 126–135] for the embedding degrees k = 16 $k=16$ , 22, 28, 40 and 46. We consider elements of the form ( a + b - D ) ζ k $(a+b\sqrt{-D})\zeta _k$ for rational numbers a, b and a square-free positive integer D, where ζ k $\zeta _k$ is a primitive k-th root of unity. We also investigate the conditions for an element of the proposed form to be suitable for our construction. Our construction uses fixed discriminants.

On the non-idealness of cyclotomic families of pairing-friendly elliptic curves

Abstract Let k = 2 m p n $k=2^mp^n$ for an odd prime p and integers m ≥ 0 and n ≥ 0. We obtain lower bounds for the ρ-values of cyclotomic families of pairing-friendly elliptic curves with embedding degree k and r ( x ) = Φ k ( x ) $r(x)=\Phi _k(x)$ . Our bounds imply that none of the families are ideal.