Constructing Pairing-Friendly Elliptic Curves Using Factorization of Cyclotomic Polynomials

Tanaka, Satoru; Nakamula, Ken

doi:10.1007/978-3-540-85538-5_10

Cited by 15 publications

(22 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We note that constructions 6.11-6.14 in [18] are due to [28]. The construction of BN curves for k = 12 was given in [8] and construction 6.10 for k = 8 curves is due to [41]. For each embedding degree, we also present the loop length ratios m opt : T e : r, where m opt is the loop parameter of the optimal ate pairing, T e is the loop parameter of the twisted ate pairing and r is the loop parameter of the standard Tate pairing.…”

Section: Comparisonsmentioning

confidence: 98%

Faster Pairing Computations on Curves with High-Degree Twists

Costello

Lange

Naehrig

2010

Public Key Cryptography – PKC 2010

100

View full text Add to dashboard Cite

Abstract. Research on efficient pairing implementation has focussed on reducing the loop length and on using high-degree twists. Existence of twists of degree larger than 2 is a very restrictive criterion but luckily constructions for pairing-friendly elliptic curves with such twists exist. In fact, Freeman, Scott and Teske showed in their overview paper that often the best known methods of constructing pairing-friendly elliptic curves over fields of large prime characteristic produce curves that admit twists of degree 3, 4 or 6.A few papers have presented explicit formulas for the doubling and the addition step in Miller's algorithm, but the optimizations were all done for the Tate pairing with degree-2 twists, so the main usage of the high-degree twists remained incompatible with more efficient formulas.In this paper we present efficient formulas for curves with twists of degree 2, 3, 4 or 6. These formulas are significantly faster than their predecessors. We show how these faster formulas can be applied to Tate and ate pairing variants, thereby speeding up all practical suggestions for efficient pairing implementations over fields of large characteristic.

show abstract

Section: Comparisonsmentioning

confidence: 98%

Faster Pairing Computations on Curves with High-Degree Twists

Costello

Lange

Naehrig

2010

Public Key Cryptography – PKC 2010

100

View full text Add to dashboard Cite

show abstract

“…We generate Cocks-Pinch-8 parameters with D = 4, r of fixed length 256 bits, and h y growing from 1 to 128 bits, so that p grows from 512 to 768 bits. We compare to Tanaka-Nakamula curves of k = 8 (TN-8) [51] where p(x) has degree 6, and Fotiadis-Konstantinou curves of k = 8 and D = 4 (FK-8) [24, Table 3] where p(x) has degree 8. We obtain Figure 4.…”

Section: Evolution Of DL Cost As H T H Y Increase For K = 6mentioning

confidence: 99%

Cocks–Pinch curves of embedding degrees five to eight and optimal ate pairing computation

Guillevic

Masson

Thomé

2020

Des. Codes Cryptogr.

View full text Add to dashboard Cite

Recent algorithmic improvements of discrete logarithm computation in special extension fields threaten the security of pairing-friendly curves used in practice. A possible answer to this delicate situation is to propose alternative curves that are immune to these attacks, without compromising the efficiency of the pairing computation too much. We follow this direction, and focus on embedding degrees 5 to 8; we extend the Cocks-Pinch algorithm to obtain pairing-friendly curves with an efficient ate pairing. We carefully select our curve parameters so as to thwart possible attacks by "special" or "tower" Number Field Sieve algorithms. We target a 128-bit security level, and back this security claim by time estimates for the DLP computation. We also compare the efficiency of the optimal ate pairing computation on these curves to k = 12 curves (Barreto-Naehrig, Barreto-Lynn-Scott), k = 16 curves (Kachisa-Schaefer-Scott) and k = 1 curves (Chatterjee-Menezes-Rodríguez-Henríquez).

show abstract

“…A computer search for further factorizations of Φ k (u(x)) for various values of k and degrees of u found the following example for k = 8; Tanaka and Nakamula [83] have given similar constructions using the same idea. …”

Section: Example 65 ([17]) Letmentioning

confidence: 99%

A Taxonomy of Pairing-Friendly Elliptic Curves

2009

View full text Add to dashboard Cite

Abstract. Elliptic curves with small embedding degree and large prime-order subgroup are key ingredients for implementing pairingbased cryptographic systems. Such "pairing-friendly" curves are rare and thus require specific constructions. In this paper we give a single coherent framework that encompasses all of the constructions of pairing-friendly elliptic curves currently existing in the literature. We also include new constructions of pairing-friendly curves that improve on the previously known constructions for certain embedding degrees. Finally, for all embedding degrees up to 50, we provide recommendations as to which pairing-friendly curves to choose to best satisfy a variety of performance and security requirements.

show abstract

Constructing Pairing-Friendly Elliptic Curves Using Factorization of Cyclotomic Polynomials

Cited by 15 publications

References 7 publications

Faster Pairing Computations on Curves with High-Degree Twists

Faster Pairing Computations on Curves with High-Degree Twists

Cocks–Pinch curves of embedding degrees five to eight and optimal ate pairing computation

A Taxonomy of Pairing-Friendly Elliptic Curves

Contact Info

Product

Resources

About