Internet-Draft | Pairing-Friendly Curves | March 2020 |
Sakemi, et al. | Expires 28 September 2020 | [Page] |
This memo introduces pairing-friendly curves used for constructing pairing-based cryptography. It describes recommended parameters for each security level and recent implementations of pairing-friendly curves.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 28 September 2020.¶
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
Elliptic curve cryptography is one of the important areas in recent cryptography. The cryptographic algorithms based on elliptic curve cryptography, such as ECDSA (Elliptic Curve Digital Signature Algorithm), are widely used in many applications.¶
Pairing-based cryptography, a variant of elliptic curve cryptography, has attracted the attention for its flexible and applicable functionality. Pairing is a special map defined over elliptic curves. Thanks to the characteristics of pairing, it can be applied to construct several cryptographic algorithms and protocols such as identity-based encryption (IBE), attribute-based encryption (ABE), authenticated key exchange (AKE), short signatures and so on. Several applications of pairing-based cryptography are now in practical use.¶
As the importance of pairing grows, elliptic curves where pairing is efficiently computable are studied and the special curves called pairing-friendly curves are proposed.¶
Several applications using pairing-based cryptography are standardized and implemented. We show example applications available in the real world.¶
IETF publishes RFCs for pairing-based cryptography such as Identity-Based Cryptography [RFC5091], Sakai-Kasahara Key Encryption (SAKKE) [RFC6508], and Identity-Based Authenticated Key Exchange (IBAKE) [RFC6539]. SAKKE is applied to Multimedia Internet KEYing (MIKEY) [RFC6509] and used in 3GPP [SAKKE].¶
Pairing-based key agreement protocols are standardized in ISO/IEC [ISOIEC11770-3]. In [ISOIEC11770-3], a key agreement scheme by Joux [Joux00], identity-based key agreement schemes by Smart-Chen-Cheng [CCS07] and by Fujioka-Suzuki-Ustaoglu [FSU10] are specified.¶
MIRACL implements M-Pin, a multi-factor authentication protocol [M-Pin]. M-Pin protocol includes a kind of zero-knowledge proof, where pairing is used for its construction.¶
Trusted Computing Group (TCG) specifies ECDAA (Elliptic Curve Direct Anonymous Attestation) in the specification of Trusted Platform Module (TPM) [TPM]. ECDAA is a protocol for proving the attestation held by a TPM to a verifier without revealing the attestation held by that TPM. Pairing is used for constructing ECDAA. FIDO Alliance [FIDO] and W3C [W3C] also published ECDAA algorithm similar to TCG.¶
Intel introduces Intel Enhanced Privacy ID (EPID) which enables remote attestation of a hardware device while preserving the privacy of the device as a functionality of Intel Software Guard Extensions (SGX) [EPID]. They extend TPM ECDAA to realize such functionality. A pairing-based EPID has been proposed [BL10] and distributed along with Intel SGX applications.¶
Zcash implements their own zero-knowledge proof algorithm named zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) [Zcash]. zk-SNARKs is used for protecting privacy of transactions of Zcash. They use pairing for constructing zk-SNARKS.¶
Cloudflare introduces Geo Key Manager [Cloudflare] to restrict distribution of customers' private keys to the subset of their data centers. To achieve this functionality, attribute-based encryption is used and pairing takes a role as a building block. In addition, Cloudflare published a new cryptographic library CIRCL[CIRCL] (Cloudflare Interoperable, Reusable Cryptographic Library) in 2019. They plan for supporting secure pairing-friendly curves in CIRCL.¶
Recently, Boneh-Lynn-Shacham (BLS) signature schemes are being standardized [I-D.boneh-bls-signature] and utilized in several blockchain projects such as Ethereum [Ethereum], Algorand [Algorand], Chia Network [Chia] and DFINITY [DFINITY]. The aggregation functionality of BLS signatures is effective for their applications of decentralization and scalability.¶
The goal of this memo is to consider the security of pairing-friendly curves used in pairing-based cryptography and introduce secure parameters of pairing-friendly curves. Specifically, we explain the recent attack against pairing-friendly curves and how much the security of the curves is reduced. We show how to evaluate the security of pairing-friendly curves and give the parameters for 100 bits of security, which is no longer secure, 128, 192 and 256 bits of security.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
Let p > 3 be a prime and q = p^n for a natural number n. Let F_q be a finite field. The curve defined by the following equation E is called an elliptic curve.¶
E : y^2 = x^3 + A * x + B,¶
where x and y are in F_q, and A and B in F_q satisfy the discriminant inequality 4 * A^3 + 27 * B^2 != 0 mod q. This is called Weierstrass normal form of an elliptic curve.¶
Solutions (x, y) for an elliptic curve E, as well as the point at infinity, O_E, are called F_q-rational points. If P and Q are two points on the curve E, we can define R = P + Q as the opposite point of the intersection between the curve E and the line that passes through P and Q. We can define P + O_E = P = O_E + P as well. Similarly, we can define 2P = P + P and a scalar multiplication S = [a]P for a positive integer a can be defined as an (a-1)-time addition of P.¶
The additive group, denoted by E(F_q), is constructed by the set of F_q-rational points and the addition law described above. We can define the cyclic additive group with a prime order r by taking a base point BP in E(F_q) as a generator. This group is used for the elliptic curve cryptography.¶
We define terminology used in this memo as follows.¶
Pairing is a kind of the bilinear map defined over two elliptic curves E and E'. Examples include Weil pairing, Tate pairing, optimal Ate pairing [Ver09] and so on. Especially, optimal Ate pairing is considered to be efficient to compute and mainly used for practical implementation.¶
Let E be an elliptic curve defined over a prime field F_p and E' be an elliptic curve defined over an extension field of F_p. Let k be a minimum integer such that r is a divisor of p^k - 1, which is called an embedding degree. Let G_1 be a cyclic subgroup on the elliptic curve E with order r, and G_2 be a cyclic subgroup on the elliptic curve E' with order r. Let G_T be an order r subgroup of a multiplicative group (F_p^k)^*.¶
Pairing is defined as a bilinear map e: (G_1, G_2) -> G_T satisfying the following properties:¶
A BN curve [BN05] is one of the instantiations of pairing-friendly curves proposed in 2005. A pairing over BN curves constructs optimal Ate pairings.¶
A BN curve is defined by elliptic curves E and E' parameterized by a well chosen integer t. E is defined over F_p, where p is a prime more than or equal to 5, and E(F_p) has a subgroup of prime order r. The characteristic p and the order r are parameterized by¶
p = 36 * t^4 + 36 * t^3 + 24 * t^2 + 6 * t + 1 r = 36 * t^4 + 36 * t^3 + 18 * t^2 + 6 * t + 1¶
for an integer t.¶
The elliptic curve E has an equation of the form E: y^2 = x^3 + b, where b is an element of multiplicative group of order p.¶
BN curves always have order 6 twists. If m is an element which is neither a square nor a cube in an extension field F_p^2, the twisted curve E' of E is defined over an extension field F_p^2 by the equation E': y^2 = x^3 + b' with b' = b / m or b' = b * m. BN curves are called D-type if b' = b / m, and M-type if b' = b * m. The embedded degree k is 12.¶
A pairing e is defined by taking G_1 as a subgroup of E(F_p) of order r, G_2 as a subgroup of E'(F_p^2), and G_T as a subgroup of a multiplicative group (F_p^12)^* of order r.¶
A BLS curve [BLS02] is another instantiations of pairings proposed in 2002. Similar to BN curves, a pairing over BLS curves constructs optimal Ate pairings.¶
A BLS curve is elliptic curves E and E' parameterized by a well chosen integer t. E is defined over a finite field F_p by an equation of the form E: y^2 = x^3 + b, and its twisted curve, E': y^2 = x^3 + b', is defined in the same way as BN curves. In contrast to BN curves, E(F_p) does not have a prime order. Instead, its order is divisible by a large parameterized prime r and denoted by h * r with cofactor h. The pairing will be defined on the r-torsions points. In the same way as BN curves, BLS curves can be categorized into D-type and M-type.¶
BLS curves vary according to different embedding degrees. In this memo, we deal with BLS12 and BLS48 families with embedding degrees 12 and 48 with respect to r, respectively.¶
In BLS curves, parameterized p and r are given by the following equations:¶
BLS12: p = (t - 1)^2 * (t^4 - t^2 + 1) / 3 + t r = t^4 - t^2 + 1 BLS48: p = (t - 1)^2 * (t^16 - t^8 + 1) / 3 + t r = t^16 - t^8 + 1¶
for a well chosen integer t.¶
A pairing e is defined by taking G_1 as a subgroup of E(F_p) of order r, G_2 as an order r subgroup of E'(F_p^2) for BLS12 and of E'(F_p^8) for BLS48, and G_T as an order r subgroup of a multiplicative group (F_p^12)^* for BLS12 and of a multiplicative group (F_p^48)^* for BLS48.¶
Pairing-friendly curves use a tower of some extension fields. In order to encode an element of an extension field, focusing on interoperability, we adopt the representation convention shown in Appendix J.4 of [I-D.ietf-lwig-curve-representations] as a standard and effective method.¶
Let F_p be a finite field of characteristic p and F_p^d be an extension field of F_p of degree d and an indeterminate i.¶
For an element s in F_p^d such that s = s_0 + s_1 * i + ... + s_{d - 1} * i^{d - 1} for s_0, s_1, ... , s_{d - 1} in a basefield F_p, s is represented as octet string by oct(s) = s_0 || s_1 || ... || s_{d - 1}.¶
Let F_p^d' be an extension field of F_p^d of degree d' / d and an indeterminate j.¶
For an element s' in F_p^d' such that s' = s'_0 + s'_1 * j + ... + s'_{d' / d - 1} * j^{d' / d - 1} for s'_0, s'_1, ..., s'_{d' / d - 1} in a basefield F_p^d, s' is represented as integer by oct(s') = oct(s'_0) || oct(s'_1) || ... || oct(s'_{d' / d - 1}), where oct(s'_0), ... , oct(s'_{d' / d - 1}) are octet strings encoded by above convention.¶
In general, one can define encoding between integer and an element of any finite field tower by inductively applying the above convention.¶
The parameters and test vectors of extension fields described in this memo are encoded by this convention and represented in octet stream.¶
When applications communicate elements in an extension field, using the compression method [MP04] may be more effective. In that case, you need to use it with care for interoperability.¶
The security of pairing-friendly curves is evaluated by the hardness of the following discrete logarithm problems.¶
There are other hard problems over pairing-friendly curves used for proving the security of pairing-based cryptography. Such problems include computational bilinear Diffie-Hellman (CBDH) problem and bilinear Diffie-Hellman (BDH) Problem, decision bilinear Diffie-Hellman (DBDH) problem, gap DBDH problem, etc [ECRYPT]. Almost all of these variants are reduced to the hardness of discrete logarithm problems described above and believed to be easier than the discrete logarithm problems.¶
There would be the case where the attacker solves these reduced problems to break pairing-based cryptography. Since such attacks have not been discovered yet, we discuss the hardness of the discrete logarithm problems in this memo.¶
The security level of pairing-friendly curves is estimated by the computational cost of the most efficient algorithm to solve the above discrete logarithm problems. The well-known algorithms for solving the discrete logarithm problems include Pollard's rho algorithm [Pollard78], Index Calculus [HR83] and so on. In order to make index calculus algorithms more efficient, number field sieve (NFS) algorithms are utilized.¶
In 2016, Kim and Barbulescu proposed a new variant of the NFS algorithms, the extended tower number field sieve (exTNFS), which drastically reduces the complexity of solving FFDLP [KB16]. Due to exTNFS, the security level of pairing-friendly curves asymptotically dropped down. For instance, Barbulescu and Duquesne estimated that the security of the BN curves which had been believed to provide 128 bits of security (BN256, for example) dropped down to approximately 100 bits [BD18].¶
Some papers showed the minimum bit length of the parameters of pairing-friendly curves for each security level when applying exTNFS as an attacking method for FFDLP. For 128 bits of security, Barbulescu and Duquesne estimated the minimum bit length of p of BN curves after exTNFS as 461 bits, and that of BLS12 curves as 461 bits [BD18]. For 256 bits of security, Kiyomura et al. estimated the minimum bit length of p^k of BLS48 curves as 27,410 bits, which implied 572 bits of p [KIK17].¶
In this section, we introduce secure pairing-friendly curves that consider the impact of exTNFS.¶
First, we show the adoption status of pairing-friendly curves in standards, libraries and applications, and classify them according to security level 128 bits, 192 bits, and 256 bits. Then, from the viewpoint of "security" and "widely use", pairing-friendly curves corresponding to each security level are selected and their parameters are indicated.¶
In our selection policy, it is important that selected curves are shown in peer-reviewed paper for security and that they are widely used in cryptographic libraries. In addition, "efficiency" is one of the important aspects but it is greatly depending on implementations, so we consider that viewpoint of "security" and "widely use" are more important than "efficiency" when considering interconnections and interoperability on future Internet.¶
We show the pairing-friendly curves selected by existing standards, cryptographic libraries and applications.¶
Table 1 summarizes the adoption status of pairing-friendly curves. The details are described as following subsections. A BN curve with a XXX-bit characteristic p is denoted as BNXXX and a BLS curve of embedding degree k with a XXX-bit p denoted as BLSk_XXX. Due to space limitations, Table 1 omits libraries that have not been maintained since 2016 in which exTNFS was proposed and curves that had security levels below 128 bits since before 2016 (ex. BN160). The full version of Table1 is available at https://lepidum.co.jp/blog/2020-03-27/ietf-draft-pfc/. In this table, security level for each curve is evaluated according to [BD18],[GME19], [MAF19] and [FK18]. Note that the curves marked as (*) indicate that the evaluation of security level does not take into account the impact of the exTNFS because [BD18] does not show the security level of these curves.¶
Category | Name | Curve Type | Security Levels (bit) | |||||
---|---|---|---|---|---|---|---|---|
~ | Ard 128 | ~ | Ard 192 | ~ | Ard 256 | |||
Standard | ISO/IEC | BN256I | X | |||||
BN384 | X | |||||||
BN512I | X | |||||||
Freeman224 | * | |||||||
Freeman256 | * | |||||||
MNT256 | * | |||||||
TCG | BN256I | X | ||||||
BN638 | X | |||||||
FIDO/W3C | BN256I | X | ||||||
BN256D | X | |||||||
BN512I | X | |||||||
BN638 | X | |||||||
Library | mcl | BLS12_381 | X | |||||
BN254N | X | |||||||
BN_SNARK1 | X | |||||||
BN382M | X | |||||||
BN462 | X | |||||||
TEPLA | BN254B | X | ||||||
BN254N | X | |||||||
RELIC | BLS12_381 | X | ||||||
BLS12_446 | X | |||||||
BLS12_455 | X | |||||||
BLS12_638 | X | |||||||
BLS24_477 | X | |||||||
BLS48_575 | X | |||||||
BN254N | X | |||||||
BN256D | X | |||||||
BN382R | X | |||||||
BN446 | X | |||||||
BN638 | X | |||||||
CP8_544 | X | |||||||
K54_569 | X | |||||||
KSS18_508 | X | |||||||
OT8_511 | X | |||||||
AMCL | BLS12_381 | X | ||||||
BLS12_383 | X | |||||||
BLS12_461 | X | |||||||
BLS24_479 | X | |||||||
BLS48_556 | X | |||||||
BN254N | X | |||||||
BN254CX | X | |||||||
BN256I | X | |||||||
BN512I | X | |||||||
Intel IPP | BN256I | X | ||||||
Kyushu Univ. | BLS48_581 | X | ||||||
MIRACL | BLS12_381 | X | ||||||
BLS12_383 | X | |||||||
BLS12_461 | X | |||||||
BLS24_479 | X | |||||||
BLS48_556 | X | |||||||
BLS48_581 | X | |||||||
BN254N | X | |||||||
BN254CX | X | |||||||
BN256I | X | |||||||
BN462 | X | |||||||
BN512I | X | |||||||
Adjoint | BLS12_381 | X | ||||||
BN_SNARK1 | X | |||||||
BN254B | X | |||||||
BN254N | X | |||||||
BN254S1 | X | |||||||
BN254S2 | X | |||||||
BN462 | X | |||||||
Application | Zcash | BLS12_381 | X | |||||
BN_SNARK1 | X | |||||||
Ethereum | BLS12_381 | X | ||||||
Chia Network | BLS12_381 | X | ||||||
DFINITY | BLS12_381 | X | ||||||
BN254N | X | |||||||
BN_SNARK1 | X | |||||||
BN382M | X | |||||||
BN462 | X | |||||||
Algorand | BLS12_381 | X |
ISO/IEC 15946 series specifies public-key cryptographic techniques based on elliptic curves. ISO/IEC 15946-5 [ISOIEC15946-5] shows numerical examples of MNT curves[MNT01] with 160-bit p and 256-bit p, Freeman curves[Freeman06] with 224-bit p and 256-bit p, and BN curves with 160-bit p, 192-bit p, 224-bit p, 256-bit p, 384-bit p and 512-bit p. These parameters do not take into account the effects of the exTNFS. On the other hand, the parameters may be revised in the future version since ISO/IEC 15946-5 is currently under development. As described below, BN curves with 256-bit p and 512-bit p specified in ISO/IEC 15946-5 used by other standards and libraries, these curves are especially denoted as BN256I and BN512I.¶
TCG adopts the BN256I and a BN curve with 638-bit p specified by their own[TPM]. FIDO Alliance [FIDO] and W3C [W3C] adopt BN256I, BN512I, the BN638 by TCG and the BN curve with 256-bit proposed by Devegili et al.[DSD07] (named BN256D).¶
There are a lot of cryptographic libraries that support pairing calculations.¶
PBC is a library for pairing-based cryptography published by Stanford University and it supports BN curves, MNT curves, Freeman curves, and supersingular curves[PBC]. Users can generate pairing parameters by PBC and use pairing operations with the generated parameters.¶
mcl[mcl] is a library for pairing-based cryptography which supports four BN curves and BLS12_381. These BN curves include BN254 proposed by Nogami et al. [NASKM08] (named BN254N), BN_SNARK1 suitable for SNARK applications[libsnark], BN382M, and BN462. Kyushu university publishes a library that supports the BLS48_581[BLS48]. University of Tsukuba Elliptic Curve and Pairing Library (TEPLA)[TEPLA] supports two BN curves, one is BN254N and the other is BN254 proposed by Beuchat et al. [BGMORT10] (named BN254B). Intel publishes a cryptographic library named Intel Integrated Performance Primitives(Intel-IPP)[Intel-IPP] and the library supports BN256I.¶
RELIC[RELIC] uses various types of pairing-friendly curves that include six BN curves (BN158, BN254R, BN256R, BN382R, BN446, and BN638), where BN254R, BN256R and BN382R are RELIC specific parameters and they are different from BN254N, BN254B, BN256I, BN256D and BN382M. In addition, RELIC supports six BLS curves (BLS12_381, BLS12_446, BLS12_445, BLS12_638, BLS24_477 and BLS48_575[MAF19]), Cocks-Pinch curves of embedding degree 8 with 544-bit p[GME19], pairing-friendly curves constructed by Scott et al.[SG19] based on Kachisa-Scott-Schaefer curve with embedding degree 54 with 569-bit p (named K54_569)[MAF19], a KSS curve[KSS08] of embedding degree 18 with 508-bit p (named KSS18_508)[AFKMR12], Optimal TNFS-secure curve [FM19] of embedding degree 8 with 511-bit p(OT8_511), and a supersingular curve[S86] with 1536-bit p (SS_1536).¶
Apache Milagro Crypto Library (AMCL)[AMCL] supports four BLS curves (BLS12_381, BLS12_461, BLS24_479 and BLS48_556) and four BN curves (BN254N, BN254CX which is proposed by CertiVox, BN256I and BN512I). In addition to AMCL's supported curves, MIRACL[MIRACL] supports BN462 and BLS48_581.¶
Adjoint publishes a library that supports the BLS12_381 and six BN curves (BN_SNARK1, BN254B, BN254N, BN254S1, BN254S2, and BN462) [AdjointLib], where BN254S1 and BN254S2 are BN curves adopted by old version of AMCL [AMCLv2].¶
Several applications adopt pairing-friendly curves such as BN curves and BLS curves.¶
Zcash implements a BN curve (named BN128) in their library libsnark [libsnark]. After exTNFS, they propose a new parameter of BLS12 as BLS12_381 [BLS12-381] and publish its experimental implementation [zkcrypto].¶
Ethereum 2.0 adopts the BLS12_381 and uses implementation by Meyer[pureGo-bls]. Chia Network publishes their implementation [Chia] by integrating the RELIC toolkit [RELIC]. DFINITY uses mcl and Algorand publishes their implementation which supports BLS12_381.¶
Before exTNFS, BN curves with 256-bit size of underlying finite field (so-called BN256) were considered to achieve 128 bits of security. After exTNFS, however, the security level of BN curves with 256-bit size of underlying finite field fell into 100 bits.¶
Implementers who will newly develop the applications of pairing-based cryptography SHOULD NOT use pairing-friendly curves with 100 bits of security (i.e. BN256).¶
There exists applications which already implemented pairing-based cryptography with 100-bit secure pairing-friendly curves. In such a case, implementers MAY use 100 bits of security only if they need to keep interoperability with the existing applications.¶
Table 1 shows that a lot of pairing-friendly curves whose curve types are BN curves and BLS curves are adopted as curves of 128 bits security level. Among them, the one that best matches our selection policy is BN462, so we introduce the parameters of BN462 in this section.¶
On the other hand, from the viewpoint of "widely use", BLS12_381 is an attractive curve because a lot of libraries and applications adopt it. However, because it is not published as a curve of 128-bit security level in peer-reviewed papers, it does not match our selection policy. In addition, according to [BD18], the bit length of p for BLS12 to achieve 128 bits of security is calculated as 461 bits and more, which BLS12_381 does not satisfy. Since BLS12_381 has a large influence from the viewpoint of interoperability, we introduce parameters of BLS12_381 in Appendix C.¶
A BN curve with 128 bits of security is shown in [BD18], which we call BN462. BN462 is defined by a parameter¶
t = 2^114 + 2^101 - 2^14 - 1¶
for the definition in Section 2.3.¶
For the finite field F_p, the towers of extension field F_p^2, F_p^6 and F_p^12 are defined by indeterminates u, v, w as follows:¶
F_p^2 = F_p[u] / (u^2 + 1) F_p^6 = F_p^2[v] / (v^3 - u - 2) F_p^12 = F_p^6[w] / (w^2 - v).¶
Defined by t, the elliptic curve E and its twisted curve E' are represented by E: y^2 = x^3 + 5 and E': y^2 = x^3 - u + 2, respectively. The size of p becomes 462-bit length. A pairing e is defined by taking G_1 as a cyclic group of order r generated by a base point BP = (x, y) in F_p, G_2 as a cyclic group of order r generated by a based point BP' = (x', y') in F_p^2, and G_T as a subgroup of a multiplicative group (F_p^12)^* of order r. BN462 is D-type.¶
We give the following parameters for BN462.¶
As shown in Table 1, candidates of pairing-friendly curves for the security level 192 bits are only two curves BLS24_477 and BLS24_479. BLS24_477 has only one implementation and BLS24_479 is an experimental parameter which is not shown in peer-reviewed paper. Therefore, because none match our selection policy, we couldn't show parameters for security level 192 bits here.¶
As shown in Table 1, there are three candidats of pairing-friendly curves for security level 256 bit. According to our selection policy, we select BLS48_581 which is the most adopted by cryptographic libraries.¶
The selected BLS48 curve is shown in [KIK17] and it is defined by a parameter¶
t = -1 + 2^7 - 2^10 - 2^30 - 2^32.¶
For the finite field F_p, the towers of extension field F_p^2, F_p^4, F_p^8, F_p^24 and F_p^48 are defined by indeterminates u, v, w, z, s as follows:¶
F_p^2 = F_p[u] / (u^2 + 1) F_p^4 = F_p^2[v] / (v^2 + u + 1) F_p^8 = F_p^4[w] / (w^2 + v) F_p^24 = F_p^8[z] / (z^3 + w) F_p^48 = F_p^24[s] / (s^2 + z).¶
The elliptic curve E and its twisted curve E' are represented by E: y^2 = x^3 + 1 and E': y^2 = x^3 - 1 / w. A pairing e is defined by taking G_1 as a cyclic group of order r generated by a base point BP = (x, y) in F_p, G_2 as a cyclic group of order r generated by a based point BP' = (x', y') in F_p^8, and G_T as a subgroup of a multiplicative group (F_p^48)^* of order r. The size of p becomes 581-bit length. BLS48-581 is D-type.¶
We then give the parameters for BLS48-581 as follows.¶
G_1 defined over E: y^2 = x^3 + b¶
G_2 defined over E': y^2 = x^3 + b'¶
BP' = (x', y') : a base point (encoded with [I-D.ietf-lwig-curve-representations])¶
This memo entirely describes the security of pairing-friendly curves, and introduces secure parameters of pairing-friendly curves. We give these parameters in terms of security, efficiency and global acceptance. The parameters for 100, 128, 192 and 256 bits of security are introduced since the security level will different in the requirements of the pairing-based applications. Implementers can select these parameters according to their security requirements.¶
This document has no actions for IANA.¶
The authors would like to thank Akihiro Kato and Shoko Yonezawa for their significant contribution to the early version of this memo. The authors would also like to acknowledge Sakae Chikara, Kim Taechan, Hoeteck Wee, Sergey Gorbunov and Michael Scott for their valuable comments.¶
Before presenting the computation of optimal Ate pairing e(P, Q) satisfying the properties shown in Section 2.2, we give subfunctions used for pairing computation.¶
The following algorithm Line_Function shows the computation of the line function. It takes A = (A[1], A[2]), B = (B[1], B[2]) in G_2 and P = ((P[1], P[2])) in G_1 as input and outputs an element of G_T.¶
if (A = B) then l := (3 * A[1]^2) / (2 * A[2]); else if (A = -B) then return P[1] - A[1]; else l := (B[2] - A[2]) / (B[1] - A[1]); end if; return (l * (P[1] -A[1]) + A[2] -P[2]);¶
When implementing the line function, implementers should consider the isomorphism of E and its twisted curve E' so that one can reduce the computational cost of operations in G_2. We note that the function Line_function does not consider such isomorphism.¶
Computation of optimal Ate pairing for BN curves uses Frobenius map. Let a Frobenius map pi for a point Q = (x, y) over E' be pi(p, Q) = (x^p, y^p).¶
Let c = 6 * t + 2 for a parameter t and c_0, c_1, ... , c_L in {-1,0,1} such that the sum of c_i * 2^i (i = 0, 1, ..., L) equals to c.¶
The following algorithm shows the computation of optimal Ate pairing over Barreto-Naehrig curves. It takes P in G_1, Q in G_2, an integer c, c_0, ...,c_L in {-1,0,1} such that the sum of c_i * 2^i (i = 0, 1, ..., L) equals to c, and an order r as input, and outputs e(P, Q).¶
f := 1; T := Q; if (c_L = -1) T := -T; end if for i = L-1 to 0 f := f^2 * Line_function(T, T, P); T := 2 * T; if (c_i = 1 | c_i = -1) f := f * Line_function(T, c_i * Q); T := T + c_i * Q; end if end for Q_1 := pi(p, Q); Q_2 := pi(p, Q_1); f := f * Line_function(T, Q_1, P); T := T + Q_1; f := f * Line_function(T, -Q_2, P); f := f^{(p^k - 1) / r} return f;¶
Let c = t for a parameter t and c_0, c_1, ... , c_L in {-1,0,1} such that the sum of c_i * 2^i (i = 0, 1, ..., L) equals to c. The following algorithm shows the computation of optimal Ate pairing over Barreto-Lynn-Scott curves. It takes P in G_1, Q in G_2, a parameter c, c_0, c_1, ..., c_L in {-1,0,1} such that the sum of c_i * 2^i (i = 0, 1, ..., L), and an order r as input, and outputs e(P, Q).¶
f := 1; T := Q; if (c_L = -1) T := -T; end if for i = L-1 to 0 f := f^2 * Line_function(T, T, P); T := 2 * T; if (c_i = 1 | c_i = -1) f := f * Line_function(T, c_i * Q, P); T := T + c_i * Q; end if end for f := f^{(p^k - 1) / r}; return f;¶
We provide test vectors for Optimal Ate Pairing e(P, Q) given in Appendix A for the curves BN462 and BLS48-581 given in Section 4. Here, the inputs P = (x, y) and Q = (x', y') are the corresponding base points BP and BP' given in Section 4.¶
For BN462, Q = (x', y') is given by¶
x' = x'_0 + x'_1 * u and y' = y'_0 + y'_1 * u,¶
where u is a indeterminate and x'_0, x'_1, y'_0, y'_1 are elements of F_p.¶
For BLS48-581, Q = (x', y') is given by¶
x' = x'_0 + x'_1 * u + x'_2 * v + x'_3 * u * v + x'_4 * w + x'_5 * u * w + x'_6 * v * w + x'_7 * u * v * w and y' = y'_0 + y'_1 * u + y'_2 * v + y'_3 * u * v + y'_4 * w + y'_5 * u * w + y'_6 * v * w + y'_7 * u * v * w,¶
where u, v and w are indeterminates and x'_0, ..., x'_7 and y'_0, ..., y'_7 are elements of F_p. The representation of Q = (x', y') given below is followed by [I-D.ietf-lwig-curve-representations].¶
BN462:¶
BLS48-581:¶
In this part, we introduce parameters of the Barreto-Lynn-Scott curve of embedding degree 12 with 381 bits p that adopted by a lot of applications such as Zcash [Zcash], Ethereum [Ethereum] and so on.¶
BLS12_381 curve is shown in [BLS12-381] and it is defined by a parameter¶
t = -2^63 - 2^62 - 2^60 - 2^57 - 2^48 - 2^16¶
where the size of p becomes 381-bit length.¶
For the finite field F_p, the towers of extension field F_p^2, F_p^6 and F_p^12 are defined by indeterminates u, v, w as follows:¶
F_p^2 = F_p[u] / (u^2 + 1) F_p^6 = F_p^2[v] / (v^3 - u - 1) F_p^12 = F_p^6[w] / (w^2 - v).¶
Defined by t, the elliptic curve E and its twisted curve E' are represented by E: y^2 = x^3 + 4 and E': y^2 = x^3 + 4(u + 1).¶
A pairing e is defined by taking G_1 as a cyclic group of order r generated by a base point BP = (x, y) in F_p, G_2 as a cyclic group of order r generated by a based point BP' = (x', y') in F_p^2, and G_T as a subgroup of a multiplicative group (F_p^12)^* of order r. BLS12_381 is M-type.¶
We have to note that, according to [BD18], the bit length of p for BLS12 to achieve 128 bits of security is calculated as 461 bits and more, which BLS12_381 does not satisfy.¶
Parameters of BLS12_381 are given as follows.¶