Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

DOI10.1504/IJACT.2020.107167MaRDI QIDQ2019841zbMATH OpenOpenAlexFDO

Authors Narcisse Bang Mbiang, Diego De Freitas Aranha, Emmanuel Fouotsa

Publication date 22 April 2021

Published in International Journal of Applied Cryptography (Search for Journal in Brave)

Full work available at URL https://doi.org/10.1504/ijact.2020.107167

zbMATH Keywords

256 bits security levelelliptic curvesembedding degrees 48 and 54final exponentiationMiller loopoptimal pairingspairing-friendly curves

Mathematics Subject Classification ID

Elliptic curves over global fields (11G05) Curves over finite and local fields (11G20) Cryptography (94A60)

Review text

Summary: Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, \textit{M. Scott} and \textit{A. Guillevic} [Lect. Notes Comput. Sci. 11321, 43--57 (2018; Zbl 1446.11121)] consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Recommendations

• Improving the computation of the optimal ate pairing for a high security level
• A new family of pairing-friendly elliptic curves
• Cocks-Pinch curves of embedding degrees five to eight and optimal ate pairing computation
• Analysis of optimum pairing products at high security levels
• Optimal pairing computation over families of pairing-friendly elliptic curves

Cited in

(17)

• A new family of pairing-friendly elliptic curves
• Efficient optimal ate pairing at 128-bit security level
• A short-list of pairing-friendly curves resistant to special TNFS at the 128-bit security level
• LOVE a pairing
• Faster beta Weil pairing on BLS pairing friendly curves with odd embedding degree
• Cocks-Pinch curves of embedding degrees five to eight and optimal ate pairing computation
• Improving the computation of the optimal ate pairing for a high security level
• Tower building technique on elliptic curve with embedding degree 18
• Analysis of optimum pairing products at high security levels
• Optimal pairing computation over families of pairing-friendly elliptic curves
• Implementing pairings at the 192-bit security level
• Adequate elliptic curves for computing the product of n pairings
• Optimal ate pairing on elliptic curves with embedding degree 9, 15 and 27
• Faster optimal ate pairings for cyclotomic sparse families of pairing-friendly elliptic curves with embedding degrees k=5,7
• That's AmorE: amortized efficiency for pairing delegation
• A short-list of pairing-friendly curves resistant to the special TNFS algorithm at the 192-bit security level
• Revisiting subgroup membership testing on pairing-friendly curves via the Tate pairing

This page was built for publication: Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q2019841)