Hashing to G2 on BLS pairing-friendly curves

Abstract

When a pairing e : G 1 × G 2 → G T , on an elliptic curve E defined over F q , is exploited in a cryptographic protocol, there is often the need to hash binary strings into G 1 and G 2. Traditionally, if E admits a twistẼ of order d, then G 1 = E(F q)∩E[r], where r is a prime integer, and G 2 =Ẽ(F q k/d)∩Ẽ[r], where k is the embedding degree of E w.r.t. r. The standard approach for hashing a binary string into G 1 and G 2 is to map it to general points P ∈ E(F q) and P ∈Ẽ(F q k/d), and then multiply them by the cofactors c = #E(F q)/r and c = #Ẽ(F q k/d)/r respectively. Usually, the multiplication by c is computationally expensive. In order to speed up such a computation, two different methods (by Scott et al. and by Fuentes et al.) have been proposed. In this poster we consider these two methods for BLS pairing-friendly curves having k ∈ {12, 24, 30, 42, 48}, providing efficiency comparisons. When k = 42, 48, the Fuentes et al. method requires an expensive one-off pre-computation which was infeasible for the computational power at our disposal. In these cases, we theoretically obtain hashing maps that follow Fuentes et al. idea.

Fast Hashing to $${\mathbb {G}}_{2}$$ on Aurifeuillean Pairing-Friendly Elliptic Curves

“…Previous works [9,11] on hashing into 2 using the Scott et al's method with BLS curves, MNT curves, KSS curves, and Freeman curves provided some computational costs that we confront to the results obtained in this work. We consider the notations A for point addition, D for point doubling, X for a scalar multiplication by the parameter x and an application of the endomorphism (.).…”

“…Two methods are used for efficient hashing into 2 : the Scott et al's method [9] and Fuentes et al's method [10]. Those methods have been applied to BN curves and BLS curves [11] and other curves [9]. This work continues the same line of research in which we consider hashing into 2 on the newly constructed pairing-friendly curves introduced by Scott and Guillevic [12].…”