National Institute of Standards and Technology における超伝導研究及び生活

Previously known techniques to construct pairing-friendly curves of prime or near-prime order are restricted to embedding degree $k \leqslant 6 $. More general methods produce curves over ${\mathbb F}_{p}$ where the bit length of p is often twice as large as that of the order r of the subgroup with embedding degree k; the best published results achieve ρ ≡ log(p)/log(r) ~ 5/4. In this paper we make the first step towards surpassing these limitations by describing a method to construct elliptic curves of prime order and embedding degree k = 12. The new curves lead to very efficient implementation: non-pairing operations need no more than ${\mathbb F}_{p^4}$ arithmetic, and pairing values can be compressed to one third of their length in a way compatible with point reduction techniques. We also discuss the role of large CM discriminants D to minimize ρ; in particular, for embedding degree k = 2q where q is prime we show that the ability to handle log(D)/log(r) ~ (q–3)/(q–1) enables building curves with ρ ~ q/(q–1).

/pdf/pairing-friendly-elliptic-curves-of-prime-order-3rn59setuq.pdf

Pairing-Friendly elliptic curves of prime order

We describe a short signature scheme that is strongly existentially unforgeable under an adaptive chosen message attack in the standard security model. Our construction works in groups equipped with an efficient bilinear map, or, more generally, an algorithm for the Decision Diffie-Hellman problem. The security of our scheme depends on a new intractability assumption we call Strong Diffie-Hellman (SDH), by analogy to the Strong RSA assumption with which it shares many properties. Signature generation in our system is fast and the resulting signatures are as short as DSA signatures for comparable security. We give a tight reduction proving that our scheme is secure in any group in which the SDH assumption holds, without relying on the random oracle model.

/pdf/short-signatures-without-random-oracles-and-the-sdh-58d66w6a62.pdf

Short Signatures Without Random Oracles and the SDH Assumption in Bilinear Groups

Elliptic curves with small embedding degree and large prime-order subgroup are key ingredients for implementing pairing-based cryptographic systems. Such “pairing-friendly” curves are rare and thus require specific constructions. In this paper we give a single coherent framework that encompasses all of the constructions of pairing-friendly elliptic curves currently existing in the literature. We also include new constructions of pairing-friendly curves that improve on the previously known constructions for certain embedding degrees. Finally, for all embedding degrees up to 50, we provide recommendations as to which pairing-friendly curves to choose to best satisfy a variety of performance and security requirements.

/pdf/a-taxonomy-of-pairing-friendly-elliptic-curves-50a1ervgd7.pdf

A Taxonomy of Pairing-Friendly Elliptic Curves

This paper shows that a $390 mass-market quad-core 2.4GHz Intel Westmere (Xeon E5620) CPU can create 109000 signatures per second and verify 71000 signatures per second on an elliptic curve at a 2128 security level. Public keys are 32 bytes, and signatures are 64 bytes. These performance figures include strong defenses against software side-channel attacks: there is no data flow from secret keys to array indices, and there is no data flow from secret keys to branch conditions.

https://link.springer.com/content/pdf/10.1007%2Fs13389-012-0027-1.pdf

High-speed high-security signatures

In this paper we propose a binary field variant of the Joux-Lercier medium-sized Function Field Sieve, which results not only in complexities as low as $L_{q^n}(1/3,(4/9)^{1/3})$ for computing arbitrary logarithms, but also in an heuristic polynomial time algorithm for finding the discrete logarithms of degree one and two elements when the field has a subfield of an appropriate size. To illustrate the efficiency of the method, we have successfully solved the DLP in the finite fields with 21971 and 23164 elements, setting a record for binary fields.

/pdf/on-the-function-field-sieve-and-the-impact-of-higher-d1rtdhsnly.pdf

On the Function Field Sieve and the Impact of Higher Splitting Probabilities

This paper describes an extremely efficient squaring operation in the so-called ‘cyclotomic subgroup’ of $\mathbb{F}_{q^6}^{\times}$, for $q \equiv 1 \bmod{6}$. Our result arises from considering the Weil restriction of scalars of this group from $\mathbb{F}_{q^6}$ to $\mathbb{F}_{q^2}$, and provides efficiency improvements for both pairing-based and torus-based cryptographic protocols. In particular we argue that such fields are ideally suited for the latter when the field characteristic satisfies $p \equiv 1 \pmod{6}$, and since torus-based techniques can be applied to the former, we present a compelling argument for the adoption of a single approach to efficient field arithmetic for pairing-based cryptography.

/pdf/faster-squaring-in-the-cyclotomic-subgroup-of-sixth-degree-37qd95i53u.pdf

Faster squaring in the cyclotomic subgroup of sixth degree extensions

The security and performance of pairing based cryptography has provoked a large volume of research, in part because of the exciting new cryptographic schemes that it underpins. We re-examine how one should implement pairings over ordinary elliptic curves for various practical levels of security. We conclude, contrary to prior work, that the Tate pairing is more efficient than the Weil pairing for all such security levels. This is achieved by using efficient exponentiation techniques in the cyclotomic subgroup backed by efficient squaring routines within the same subgroup.

High security pairing-based cryptography revisited

The value of the Tate pairing on an elliptic curve over a finite field may be viewed as an element of an algebraic torus. Using this simple observation, we transfer techniques recently developed for torus-based cryptography to pairing-based cryptography, resulting in more efficient computations, and lower bandwidth requirements. To illustrate the efficacy of this approach, we apply the method to pairings on supersingular elliptic curves in characteristic three.

/pdf/on-small-characteristic-algebraic-tori-in-pairing-based-42swqzij4h.pdf

On Small Characteristic Algebraic Tori in Pairing-Based Cryptography

In late 2012 and early 2013 the discrete logarithm problem (DLP) in finite fields of small characteristic underwent a dramatic series of breakthroughs, culminating in a heuristic quasi-polynomial time algorithm, due to Barbulescu, Gaudry, Joux and Thome. Using these developments, Adj, Menezes, Oliveira and Rodriguez-Henriquez analysed the concrete security of the DLP, as it arises from pairings on (the Jacobians of) various genus one and two supersingular curves in the literature, which were originally thought to be 128-bit secure. In particular, they suggested that the new algorithms have no impact on the security of a genus one curve over ${\mathbb F}_{2^{1223}}$, and reduce the security of a genus two curve over ${\mathbb F}_{2^{367}}$ to 94.6 bits. In this paper we propose a new field representation and efficient general descent principles which together make the new techniques far more practical. Indeed, at the ‘128-bit security level’ our analysis shows that the aforementioned genus one curve has approximately 59 bits of security, and we report a total break of the genus two curve.

/pdf/breaking-128-bit-secure-supersingular-binary-curves-1dzkmjeef4.pdf

Robert Granger

Papers

On the Function Field Sieve and the Impact of Higher Splitting Probabilities

Faster squaring in the cyclotomic subgroup of sixth degree extensions

High security pairing-based cryptography revisited

On Small Characteristic Algebraic Tori in Pairing-Based Cryptography

Breaking ‘128-bit Secure’ Supersingular Binary Curves