Efficient hash maps to $${\mathbb {G}}_2$$ on BLS curves

Budroni, Alessandro; Pintore, Federico

doi:10.1007/s00200-020-00453-9

Cited by 5 publications

(2 citation statements)

References 32 publications

(52 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We will use four independent hash functions H i : {0, 1} * → Z p for ∀i ∈ {1, 2, 3} and H G2 : {0, 1} * → G 2 modeled as random oracles. Note that H G2 can be implemented fast using the hashing algorithms [49,50], and the speed of calculating H G2 is doubled in the case of Barreto-Naehrig (BN) curves [49]. Setup.…”

Section: B Detailed Constructionmentioning

confidence: 99%

Direct Anonymous Attestation With Optimal TPM Signing Efficiency

Yang

Chen

Zhang

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Direct Anonymous Attestation (DAA) is an anonymous signature scheme, which allows the Trusted Platform Module (TPM), a small chip embedded in a host computer, to attest to the state of the host system, while preserving the privacy of the user. DAA provides two signature modes: fully anonymous signatures and pseudonymous signatures. One main goal of designing DAA schemes is to reduce the TPM signing workload as much as possible, as the TPM has only limited resources. In an optimal DAA scheme, the signing workload on the TPM will be no more than that required for a normal signature like ECSchnorr. To date, no scheme has achieved the optimal signing efficiency for both signature modes.In this paper, we propose the first DAA scheme which achieves the optimal TPM signing efficiency for both signature modes. In this scheme, the TPM takes only a single exponentiation to generate a signature, and this single exponentiation can be precomputed. Our scheme can be implemented using the existing TPM 2.0 commands, and thus is compatible with the TPM 2.0 specification. We benchmarked the TPM 2.0 commands needed for three DAA use cases on an Infineon TPM 2.0 chip, and also implemented the host signing and verification algorithm for our DAA scheme on a laptop with 1.80GHz Intel Core i7-8550U CPU. Our experimental results show that our DAA scheme obtains a total signing time of about 144 ms for either signature mode, while with pre-computation we can obtain a signing time of about 65 ms. Based on our benchmark results for the pseudonymous signature mode, our scheme is roughly 2× (resp., 5×) faster than the existing DAA schemes supported by TPM 2.0 in terms of total (resp., online) signing efficiency.

show abstract

Section: B Detailed Constructionmentioning

confidence: 99%

Direct Anonymous Attestation With Optimal TPM Signing Efficiency

Yang

Chen

Zhang

et al. 2021

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…A pairing is a bilinear map from two groups G 1 , G 2 into a target group G T and is available on dedicated pairing-friendly elliptic curves. G 1 corresponds to general formula of the eigenvalue modulo the cofactor is not always well-defined at all primes [6].…”

Section: Introductionmentioning

confidence: 99%

Co-factor Clearing and Subgroup Membership Testing on Pairing-Friendly Curves

Housni

Guillevic

Piellard³

2022

Progress in Cryptology - AFRICACRYPT 2022

View full text Add to dashboard Cite

An important cryptographic operation on elliptic curves is hashing to a point on the curve. When the curve is not of prime order, the point is multiplied by the cofactor so that the result has a prime order. This is important to avoid small subgroup attacks for example. A second important operation, in the composite-order case, is testing whether a point belongs to the subgroup of prime order. A pairing is a bilinear map e : G1×G2 → GT where G1 and G2 are distinct subgroups of prime order r of an elliptic curve, and GT is a multiplicative subgroup of the same prime order r of a finite field extension. Pairing-friendly curves are rarely of prime order. We investigate cofactor clearing and subgroup membership testing on these composite-order curves. First, we generalize a result on faster cofactor clearing for BLS curves to other pairingfriendly families of a polynomial form from the taxonomy of Freeman, Scott and Teske. Second, we investigate subgroup membership testing for G1 and G2. We fix a proof argument for the G2 case that appeared in a preprint by Scott in late 2021 and has recently been implemented in different cryptographic libraries. We then generalize the result to both G1 and G2 and apply it to different pairing-friendly families of curves. This gives a simple and shared framework to prove membership tests for both cryptographic subgroups. preprint version available on ePrint at https://eprint.iacr.org/2022/352 and HAL at https://hal.inria.fr/hal-03608264, SageMath verification script at https://gitlab.inria.fr/zk-curves/cofactor. a subgroup of prime order r of the elliptic curve over a prime field F q , G 2 is a distinct subgroup of points of order r, usually over some extension F q k , and G T is the target group in a finite field F q k , where k is the embedding degree.The choices of pairing-friendly curves of prime order over F q are limited to the MNT curves (Miyaji, Nakabayashi, Takano) of embedding degree 3, 4, or 6, Freeman curves of embedding degree 10, and Barreto-Naehrig curves of embedding degree 12. Because of the new NFS variant of Kim and Barbulescu, Gaudry, and Kleinjung (TNFS), the discrete logarithm problem in extension fields GF(q k ) is not as hard as expected, and key sizes and pairing-friendly curve recommendations are now updated. In this new list of pairing-friendly curves, BN curves are no longer the best choice in any circumstances. The widely deployed curve is now the BLS12-381 curve: a Barreto-Lynn-Scott curve of embedding degree 12, with a subgroup of 255-bit prime order, defined over a 381-bit prime field. The parameters of this curve have a polynomial form, and in particular, the cofactor has a square term: c 1 (x) = (x − 1) 2 /3 were x is the seed −(2 63 + 2 62 + 2 60 + 2 57 + 2 48 + 2 16 ).One important cryptographic operation is to hash from a (random) string to a point on the elliptic curve. This operation has two steps: first mapping a string to a point P (x, y) on the curve, then multiplying the point by the cofactor so that it falls into the cryptographic subgroup....

show abstract