Breaking Pairing-Based Cryptosystems Using η T Pairing over GF(397)

Abstract

Abstract. There are many useful cryptographic schemes, such as ID-based encryption, short signature, keyword searchable encryption, attribute-based encryption, functional encryption, that use a bilinear pairing. It is important to estimate the security of such pairing-based cryptosystems in cryptography. The most essential number-theoretic problem in pairing-based cryptosystems is the discrete logarithm problem (DLP) because pairing-based cryptosystems are no longer secure once the underlining DLP is broken. One efficient bilinear pairing is the ηT pairing defined over a supersingular elliptic curve E on the finite field GF (3 n ) for a positive integer n. The embedding degree of the ηT pairing is 6; thus, we can reduce the DLP over E on GF (3 n ) to that over the finite field GF (3 6n ). In this paper, for breaking the ηT pairing over GF (3 n ), we discuss solving the DLP over GF (3 6n ) by using the function field sieve (FFS), which is the asymptotically fastest algorithm for solving a DLP over finite fields of small characteristics. We chose the extension degree n = 97 because it has been intensively used in benchmarking tests for the implementation of the ηT pairing, and the order (923-bit) of GF (3 6·97 ) is substantially larger than the previous world record (676-bit) of solving the DLP by using the FFS. We implemented the FFS for the medium prime case (JL06-FFS), and propose several improvements of the FFS, for example, the lattice sieve for JL06-FFS and the filtering adjusted to the Galois action. Finally, we succeeded in solving the DLP over GF (3 6·97 ). The entire computational time of our improved FFS requires about 148.2 days using 252 CPU cores. Our computational results contribute to the secure use of pairing-based cryptosystems with the ηT pairing.

Performances of cryptographic accumulators

“…However, due to continuous and recent attacks [15] on existing pairing friendly curves, no officially recommended curves have been proposed until now. We hence exclude pairing-based accumulators from our evaluation.…”

Faster Index Calculus for the Medium Prime Case Application to 1175-bit and 1425-bit Finite Fields

“…Log. [11] 923 bits 813 000 CPU.hours 270 000 CPU.h 483 000 CPU.h 60 000 CPU.h This paper 1175 bits 32 000 CPU.hours 3 CPU.h 32 000 CPU.h 4 CPU.h This paper 1425 bits 32 000 CPU.hours 6 CPU.h 32 000 CPU.h < 12 CPU.h (sect. 6) To illustrate the results, we first give some discrete logarithms of factor base elements in base x − 3 modulo C. We note that, as expected, the logarithms of x and y are both zero modulo C. …”

“…To the best of our knowledge, the previous discrete logarithm record in a finite field concerned F 3 582 , a 923-bit field (see [11]). Our result thus increases the size of the previous record by more than 250 bits.…”

“…Our result thus increases the size of the previous record by more than 250 bits. In order to illustrate the running time improvements gained from our new technique, we compare in the sequel our running times and the running times from [11]. However, we wish to warn the reader than this comparison should be analyzed with care.…”

A Profitable Sub-prime Loan: Obtaining the Advantages of Composite Order in Prime-Order Bilinear Groups

“…(This slowdown also extends to the non-supersingular construction of Boneh et al, and indeed to any composite-order bilinear group.) Furthermore, from a security standpoint, a number of recent results [24,26,22,1,2] demonstrate that it is possible to efficiently compute discrete logarithms in common types of supersingular curves, so that one must be significantly more careful when working over supersingular curves than when working over their non-supersingular counterparts.…”