Elliptic Curves Suitable for Pairing Based Cryptography

Brezing, Friederike; Weng, Annegret

doi:10.1007/s10623-004-3808-4

Cited by 136 publications

(143 citation statements)

References 13 publications

Supporting

Mentioning

139

Contrasting

Unclassified

Order By: Relevance

“…Algebraic methods may produce curves with ρ closer to unity for certain values of k. Such techniques include the families of curves described by Barreto, Lynn, and Scott [3], and by Brezing and Weng [8]. The latter presents the best known results, achieving ρ ∼ 5/4 for families of curves with k = 8 or k = 24, and ρ ∼ (k + 2)/(k − 1) for prime k (hence ρ 5/4 for prime k 13).…”

Section: Introductionmentioning

confidence: 99%

Pairing-Friendly Elliptic Curves of Prime Order

Barreto

Naehrig

2006

Lecture Notes in Computer Science

608

424

View full text Add to dashboard Cite

Abstract. Previously known techniques to construct pairing-friendly curves of prime or near-prime order are restricted to embedding degree k 6. More general methods produce curves over Fp where the bit length of p is often twice as large as that of the order r of the subgroup with embedding degree k; the best published results achieve ρ ≡ log(p)/ log(r) ∼ 5/4. In this paper we make the first step towards surpassing these limitations by describing a method to construct elliptic curves of prime order and embedding degree k = 12. The new curves lead to very efficient implementation: non-pairing operations need no more than F p 4 arithmetic, and pairing values can be compressed to one third of their length in a way compatible with point reduction techniques. We also discuss the role of large CM discriminants D to minimize ρ; in particular, for embedding degree k = 2q where q is prime we show that the ability to handle log(D)/ log(r) ∼ (q − 3)/(q − 1) enables building curves with ρ ∼ q/(q − 1).

show abstract

Section: Introductionmentioning

confidence: 99%

Pairing-Friendly Elliptic Curves of Prime Order

Barreto

Naehrig

2006

Lecture Notes in Computer Science

608

424

View full text Add to dashboard Cite

show abstract

“…The first wave of this research exhausted many tricks that can be applied inside a Miller iteration, resulting in significant computational speed ups [4,6,7,34]. The second wave of improvements focussed on constructing pairingfriendly elliptic curves [5,11,37,16,8,22,9,17,28], and this research is extended and collected in [18]. The third and more recent wave of research has focussed on reducing the loop length of Miller's algorithm [35,26,3,32] to be as short as possible [42,25].…”

Section: Introductionmentioning

confidence: 99%

Faster Pairing Computations on Curves with High-Degree Twists

Costello

Lange

Naehrig

2010

Public Key Cryptography – PKC 2010

100

View full text Add to dashboard Cite

Abstract. Research on efficient pairing implementation has focussed on reducing the loop length and on using high-degree twists. Existence of twists of degree larger than 2 is a very restrictive criterion but luckily constructions for pairing-friendly elliptic curves with such twists exist. In fact, Freeman, Scott and Teske showed in their overview paper that often the best known methods of constructing pairing-friendly elliptic curves over fields of large prime characteristic produce curves that admit twists of degree 3, 4 or 6.A few papers have presented explicit formulas for the doubling and the addition step in Miller's algorithm, but the optimizations were all done for the Tate pairing with degree-2 twists, so the main usage of the high-degree twists remained incompatible with more efficient formulas.In this paper we present efficient formulas for curves with twists of degree 2, 3, 4 or 6. These formulas are significantly faster than their predecessors. We show how these faster formulas can be applied to Tate and ate pairing variants, thereby speeding up all practical suggestions for efficient pairing implementations over fields of large characteristic.

show abstract

“…For later analysis, we recall Koblitz's table about different security levels [15]. In this section, following Brezing and Weng's method [7], we generate the Ate pairing-friendly curves with k = 3 i .…”

Section: Matching Aes Security Using Public Key Systemsmentioning

confidence: 99%

“…Much work has been done on related topics, including an denominator elimination method [3], the selection of pairing-friendly groups [6], the construction of pairingfriendly curves [4] [7][8] [10] [19], the methods to shorten the Miller loop [2][9] [14] and etc.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Computing the Ate Pairing on Elliptic Curves with Embedding Degree k = 9

Lin¹,

Zhao

Zhang

et al. 2008

IEICE Transactions on Fundamentals of Electronics, Communicatio

View full text Add to dashboard Cite

Abstract. For AES 128 security level there are several natural choices for pairing-friendly elliptic curves. In particular, as we will explain, one might choose curves with k = 9 or curves with k = 12. The case k = 9has not been studied in the literature, and so it is not clear how efficiently pairings can be computed in that case. In this paper, we present efficient methods for the k = 9 case, including generation of elliptic curves with the shorter Miller loop, the denominator elimination and speed up of the final exponentiation. Then we compare the performance of these choices.From the analysis, we conclude that for pairing-based cryptography at the AES 128 security level, the Barreto-Naehrig curves are the most efficient choice, and the performance of the case k = 9 is comparable to the Barreto-Naehrig curves.

show abstract

Elliptic Curves Suitable for Pairing Based Cryptography

Cited by 136 publications

References 13 publications

Pairing-Friendly Elliptic Curves of Prime Order

Pairing-Friendly Elliptic Curves of Prime Order

Faster Pairing Computations on Curves with High-Degree Twists

Computing the Ate Pairing on Elliptic Curves with Embedding Degree k = 9

Contact Info

Product

Resources

About