A family of implementation-friendly BN elliptic curves

Abstract

Abstract. For the last decade, elliptic curve cryptography has gained increasing interest in industry and in the academic community. This is especially due to the high level of security it provides with relatively small keys and to its ability to create very efficient and multifunctional cryptographic schemes by means of bilinear pairings. Pairings require pairingfriendly elliptic curves and among the possible choices, Barreto-Naehrig (BN) curves arguably constitute one of the most versatile families. In this paper, we further expand the potential of the BN curve family. We describe BN curves that are not only computationally very simple to generate, but also specially suitable for efficient implementation on a very broad range of scenarios. We also present implementation results of the optimal ate pairing using such a curve defined over a 254-bit prime field.

Implementing Pairings at the 192-Bit Security Level

“…1 The cost of additions is ignored because of their lower overall performance impact due to the larger field size in comparison with [2,24] Final exponentiation. The final exponentiation consists of raising the Miller loop result f ∈ F p k to the e = (p k − 1)/r-th power.…”

“…An element in F p 24 can be represented using the following towering scheme: Table 6 gives the computational costs of the tower extension field arithmetic for curves with k = 24, where m 480 and i 480 denote the cost of multiplication and inversion in F p , with p a 479-bit prime. Moreover,m,s,ĩ denote the cost of multiplication, squaring and inversion in F p 2 respectively.…”

“…The Miller loop executes 48 point doublings with line evaluations, 4 point additions with line evaluations, 51 sparse multiplications and 47 squarings in F p 24 . We obtain a BLS24 Miller loop cost of 48(21m + 8m 480 ) + 4(37m + 8m 480 ) + 51(39m) + 47(36m) = 4837m + 416m 480 = 14927m 480 .…”

“…The computation of the final exponentiation requires 1 inversion, 9 exponentiations by z, 14 multiplications in F p 24 , 2 cyclotomic squarings, and 8 pth power Frobenius operations. Moreover, the cost of an exponentiation by z is 48 compressed squarings, decompression of 4 field elements and 3 multiplications in F p 24 , for a total cost of 48(12m) + 87m +ĩ + 3(54m) = 827m + 2s +ĩ.…”

Core Based Architecture to Speed Up Optimal Ate Pairing on FPGA Platform

“…High-performance arithmetic over extension fields is achieved through a tower of extensions using irreducible binomials [18]. Accordingly, in our targeted setting we represent F p 12 using the towering scheme used in [2,22]:…”