Return-Path: X-Original-To: cfrg@mail2.ietf.org Delivered-To: cfrg@mail2.ietf.org Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6851B8BC5592 for ; Tue, 18 Nov 2025 07:06:01 -0800 (PST) X-Virus-Scanned: amavisd-new at ietf.org X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=ve7jtb-com.20230601.gappssmtp.com Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dPmpcApEWFM1 for ; Tue, 18 Nov 2025 07:06:00 -0800 (PST) Received: from mail-pl1-x644.google.com (mail-pl1-x644.google.com [IPv6:2607:f8b0:4864:20::644]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id A67FD8BC54DB for ; Tue, 18 Nov 2025 07:05:02 -0800 (PST) Received: by mail-pl1-x644.google.com with SMTP id d9443c01a7336-2957850c63bso58164135ad.0 for ; Tue, 18 Nov 2025 07:05:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ve7jtb-com.20230601.gappssmtp.com; s=20230601; t=1763478296; x=1764083096; darn=ietf.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=GikDTVcFNow1BlxfIWpiHoR+7YfkJGBwicAWG6vt+UM=; b=isXyywEjDMWk9HXeNXE21rZnubskF54zzEDZRkq58APqW5ctotEjuSCJGAUZLN4WGm wrzooI+6PdwQTcEmPHjo6jmBwW3xq9yuTQmSsGRR+5OiCoR8kFmXG+Lgqy6ZCdww28QC eJp6gdRrNhjLT4AE1uWM3T4geHUexhMcXfmEoyD/FRx0bGG/Eg4J0NayiNQb+MGvSBlB tpbEhvQ2QFi5j1NVspNE9pPkXIdpwUyjMQuW5bAWWoO7WP0P5wxEOw7ihjuRS6enT4Ie bBPeNOitFr4ClT1weLODxnrr843MuRkrNRyV1oNoM/0z3ur2MP1JkVvyxOcQnrDMldix rinA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763478296; x=1764083096; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=GikDTVcFNow1BlxfIWpiHoR+7YfkJGBwicAWG6vt+UM=; b=rGIv2EC8WbUhdH/OBNDsOe/6IMOYx1KT7iXb0i9ud5bVlxfR6T7tTrnKLGoMkUgEQr M+2VVesDm6wCegIqFR8pXAc/AKa2UW8fzznT4IldF9U27kK7L3WScz9i+rtu2L6/D/Ik nPEj9hqVdgg6hPOl8mpntuW4qCOYcAoc5VgjK3oWoBwUpWspOsRqqJzGXlc5UUPGupcp sTdGMZZQlmKlJq5oZxRepmIQGFoqjygsxJK/AJzbMDtg1Cpx8bCDJ7sncQ6ZxwLsNjSc dobJChyPMSgMmR98dx/qm00LVphgicvxv3tho3jnlx7OvrDF2H9gmX+avEH9J40s0VuA Ou6w== X-Gm-Message-State: AOJu0YzqOWsDCKvKdblkJGIkOR/fqHmpAiHPRamXTCegNLvu/sz+WHuM Mz07d8BoZxadbXuXJ6Tn5QFSZ/j2thDpX8pDCNRHzFZKeeM8qgv3J3Qrw61vFVtwAR2s7JjlAyQ efzi7a8AMiT33pRg= X-Gm-Gg: ASbGncsXk462Eg7LPb/jLYzXCPN3K7d8WLfw0rcteBdVhbj0WBpp+RNAEcZg9dzW5Bl 5BVfVm7oQiBpZBlbUjfJxMCii3incGM6H+GsVJ5xhrxVYqN4azf9WjqHxZDjEiT6FnWxTp/uivu b4jTYdRvTDsw45qbOgQZWiWkusfjYN2fp9s8zAySFvH1HnQ3r/FPgW4CNBqimslpp0N2Xyhquu7 U931eMvnb/MOg8j2IbasrZxLcLP5ZWn82cKe2Dz40a/fT8LBtZyeWKtLHh4pzaUf9XaHcVn2IQH Lp5I/03HcAALqVIr9r0FQfakM+o5SGuR0U8wfrEtYxgIzGHTVd1PoDrtyT9Ciibjz70aplmS65g 2dyq6JZrI3ZNenIsBL7wAh4Tux4Ew5bfxU9eROnu/NadsSb6ErON9CcEhmMy2/dUQOofxsY+f6c dnmwT8+/VqJd0H7bUxtO2xSETPMffEBBS4jLx6Sc8= X-Google-Smtp-Source: AGHT+IE9G6tcWevZmowjWGwYBTXodQqP4whOD0rnPEWVLlWbDhP2vL17LLMGMWn2x3g3myYkAzM1mA== X-Received: by 2002:a17:903:38c7:b0:299:daf0:e044 with SMTP id d9443c01a7336-299f5583dbcmr46334965ad.18.1763478295749; Tue, 18 Nov 2025 07:04:55 -0800 (PST) Received: from smtpclient.apple ([2604:3d08:4391:3100:44c6:be45:928:b932]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2985c2346b8sm178316175ad.16.2025.11.18.07.04.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Nov 2025 07:04:54 -0800 (PST) From: John Bradley Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_686224FB-1449-4870-856A-AC865B2598B0" Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.200.81.1.6\)) Date: Tue, 18 Nov 2025 07:04:43 -0800 In-Reply-To: To: John Mattsson References: X-Mailer: Apple Mail (2.3864.200.81.1.6) Message-ID-Hash: M2DA7ICASCXB7F7FRLVQBKMZETBGDTPL X-Message-ID-Hash: M2DA7ICASCXB7F7FRLVQBKMZETBGDTPL X-MailFrom: ve7jtb@ve7jtb.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-cfrg.irtf.org-0; header-match-cfrg.irtf.org-1; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "cfrg@ietf.org" X-Mailman-Version: 3.3.9rc6 Precedence: list Subject: =?utf-8?q?=5BCFRG=5D_Re=3A_I-D_Action=3A_draft-irtf-cfrg-pairing-friendly-cu?= =?utf-8?q?rves-12=2Etxt?= List-Id: Crypto Forum Research Group Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --Apple-Mail=_686224FB-1449-4870-856A-AC865B2598B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks, John M. That aligns with the feedback I have been getting over the last couple = of weeks. Now that I am back from TPAC, I will try to follow up with the curves = authors. Any feedback on BLS signatures? Regards John B. > On Nov 18, 2025, at 5:47=E2=80=AFAM, John Mattsson = wrote: >=20 > Hi, >=20 > I think it would be good to try to publish this asap. My two cents = would be to focus on specifying: >=20 > - BLS12_381 > - One BLS24 curve, one BLS48 curve, or both. I think many people might = want some security margin when deploying pairing-based crypto. > - The ZCash serialization format >=20 > I don't think "Selection of Pairing-Friendly Curves" including what is = standardized in other SDO is essential. I think BN462 could be removed. = less is more. Correctly if I am wrong but my understanding is that = BLS12_381 is superior to BN462. Security of Pairing-Friendly Curve could = be moved to security consideration or an appendix. >=20 > Cheers, > John >=20 > On 2025-11-02, 22:17, "internet-drafts@ietf.org" = wrote: >=20 > Internet-Draft draft-irtf-cfrg-pairing-friendly-curves-12.txt is now > available. It is a work item of the Crypto Forum (CFRG) RG of the = IRTF. >=20 > Title: Pairing-Friendly Curves > Authors: Yumi Sakemi > Satoru Kanno > Riad S. Wahby > Name: draft-irtf-cfrg-pairing-friendly-curves-12.txt > Pages: 54 > Dates: 2025-11-02 >=20 > Abstract: >=20 > Pairing-based cryptography, a subfield of elliptic curve > cryptography, has received attention due to its flexible and > practical functionality. Pairings are special maps defined using > elliptic curves and it can be applied to construct several > cryptographic protocols such as identity-based encryption, = attribute- > based encryption, and so on. At CRYPTO 2016, Kim and Barbulescu > proposed an efficient number field sieve algorithm named exTNFS for > the discrete logarithm problem in a finite field. Several types of > pairing-friendly curves such as Barreto-Naehrig curves are affected > by the attack. In particular, a Barreto-Naehrig curve with a = 254-bit > characteristic was adopted by a lot of cryptographic libraries as a > parameter of 128-bit security, however, it ensures no more than the > 100-bit security level due to the effect of the attack. In this > memo, we list the security levels of certain pairing-friendly = curves, > and motivate our choices of curves. First, we summarize the = adoption > status of pairing-friendly curves in standards, libraries and > applications, and classify them in the 128-bit, 192-bit, and = 256-bit > security levels. Then, from the viewpoints of "security" and = "widely > used", we select the recommended pairing-friendly curves = considering > exTNFS. >=20 > The IETF datatracker status page for this Internet-Draft is: > = https://datatracker.ietf.org/doc/draft-irtf-cfrg-pairing-friendly-curves/ >=20 > There is also an HTML version available at: > = https://www.ietf.org/archive/id/draft-irtf-cfrg-pairing-friendly-curves-12= .html >=20 > A diff from the previous version is available at: > = https://author-tools.ietf.org/iddiff?url2=3Ddraft-irtf-cfrg-pairing-friend= ly-curves-12 >=20 > Internet-Drafts are also available by rsync at: > rsync.ietf.org::internet-drafts >=20 >=20 >=20 > _______________________________________________ > CFRG mailing list -- cfrg@irtf.org > To unsubscribe send an email to cfrg-leave@irtf.org --Apple-Mail=_686224FB-1449-4870-856A-AC865B2598B0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Thanks, John M.

That = aligns with the feedback I have been getting over the last couple of = weeks.

Now that I am back from TPAC, I will try = to follow up with the curves authors.

Any = feedback on BLS = signatures?

Regards
John B.

On Nov 18, 2025, at 5:47=E2=80=AFAM, John Mattsson = <john.mattsson=3D40ericsson.com@dmarc.ietf.org> wrote:

Hi,

I think it would be good to try to publish this asap. My two cents would = be to focus on specifying:

- BLS12_381
- One BLS24 curve, one BLS48 curve, or both. I think many people might = want some security margin when deploying pairing-based crypto.
-  The ZCash serialization format

I don't think "Selection of Pairing-Friendly Curves" including what is = standardized in other SDO is essential. I think BN462 could be removed. = less is more. Correctly if I am wrong but my understanding is that = BLS12_381 is superior to BN462. Security of Pairing-Friendly Curve could be moved to security consideration or an appendix.

Cheers,
John

On 2025-11-02, 22:17, "internet-drafts@ietf.org" = <internet-drafts@ietf.org> wrote:

Internet-Draft draft-irtf-cfrg-pairing-friendly-curves-12.txt is = now
available. It is a work item of the Crypto Forum (CFRG) RG of the = IRTF.

   Title:   Pairing-Friendly Curves
   Authors: Yumi Sakemi
=
           &nb= sp;Satoru Kanno
=
           &nb= sp;Riad S. Wahby
   = Name:    draft-irtf-cfrg-pairing-friendly-curves-12.tx= t
   Pages:   54
   Dates:   2025-11-02

Abstract:

   Pairing-based cryptography, a subfield of elliptic = curve
   cryptography, has received attention due to its = flexible and
   practical functionality.  Pairings are = special maps defined using
   elliptic curves and it can be applied to construct = several
   cryptographic protocols such as identity-based = encryption, attribute-
   based encryption, and so on.  At CRYPTO = 2016, Kim and Barbulescu
   proposed an efficient number field sieve algorithm = named exTNFS for
   the discrete logarithm problem in a finite = field.  Several types of
   pairing-friendly curves such as Barreto-Naehrig curves = are affected
   by the attack.  In particular, a = Barreto-Naehrig curve with a 254-bit
   characteristic was adopted by a lot of cryptographic = libraries as a
   parameter of 128-bit security, however, it ensures no = more than the
   100-bit security level due to the effect of the = attack.  In this
   memo, we list the security levels of certain = pairing-friendly curves,
   and motivate our choices of curves.  First, = we summarize the adoption
   status of pairing-friendly curves in standards, = libraries and
   applications, and classify them in the 128-bit, = 192-bit, and 256-bit
   security levels.  Then, from the viewpoints = of "security" and "widely
   used", we select the recommended pairing-friendly = curves considering
   exTNFS.

The IETF datatracker status page for this Internet-Draft is:

There is also an HTML version available at:

A diff from the previous version is available at:
https://author-to= ols.ietf.org/iddiff?url2=3Ddraft-irtf-cfrg-pairing-friendly-curves-12<= /div>

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts



_______________________________________________
CFRG mailing list -- = cfrg@irtf.org
To unsubscribe send an email to = cfrg-leave@irtf.org

= --Apple-Mail=_686224FB-1449-4870-856A-AC865B2598B0--