Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt
Shoko YONEZAWA <yonezawa@lepidum.co.jp> Thu, 02 May 2019 10:03 UTC
Return-Path: <yonezawa@lepidum.co.jp>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33B3D120322 for <cfrg@ietfa.amsl.com>; Thu, 2 May 2019 03:03:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lepidum-co-jp.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3IuXNlh3G47q for <cfrg@ietfa.amsl.com>; Thu, 2 May 2019 03:03:11 -0700 (PDT)
Received: from mail-pf1-x42f.google.com (mail-pf1-x42f.google.com [IPv6:2607:f8b0:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0D5212009C for <cfrg@irtf.org>; Thu, 2 May 2019 03:03:11 -0700 (PDT)
Received: by mail-pf1-x42f.google.com with SMTP id v80so875905pfa.3 for <cfrg@irtf.org>; Thu, 02 May 2019 03:03:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lepidum-co-jp.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=j1g5ERXzdwwwraYRXSQhJUglOJdtW+GI/4nNzfH4H9w=; b=Z2WQkCYqEXle/D8SczDNWvZvaFdZAHfW3llKY4M2oyvOhIADy6xteS7/FhnrL93ctE kDeaynEtW3PrUbYInpW1nDALYN7vghR7P9KXThl8sO25dOz5cf+uy/rShUSkcCUFl9sa qBTVYWBAc9lpJzic1DiWJUXeCavTdZLDoEtHBRgmwbdzxfF0waUOpIgE7dLFAvZytj2f Q3bikSPmR5y//CX6vriPvMRYZMXUwoKExknDhh+qIztKc1ni/I/AgpQ98bAckbgeVUR3 9FLsznAU8zxBKJccp9cb+7zvGx6DyWuqDJ7DXjzO1Si3CNFU3jzIE33NIaXcFdazpDqo 5Y0g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=j1g5ERXzdwwwraYRXSQhJUglOJdtW+GI/4nNzfH4H9w=; b=Ir0u/ZxiR7IycXGrGB1tNFDcRStgtt9EO6wx/s6+iyKEJ0z4d6p8uaAR/+1Cp5gww3 MEHfcfxESjg2U3qItM1854jibFH7XI4dacx0XCrcrVBrc9EWp7HAlf87cD+N4Ov5AW3u nfQiIJ8IZPuEEL/zXQCKcCPYKkuWPVJv6+QZqWEColmxR1XqPlfZ+NWCccygjze+I5CL X6/7TASEUhInFRTDQFAbi8STK7amv2R9ozgwcmQpfz/dNE+TEaxGy82VtI0UeWgvcLBa qZcAsxWQKJ9tw/K7vSRHk5AUtFadErV7cAcnqg/dgco5Gftuz0W13IS9Smi5u4mSvbiO AzyA==
X-Gm-Message-State: APjAAAVpyE77MIDlQVbr/AqxUCshDsezZ5rqnLxeguhktZsmJLyOi1uf wQxb6Id1PrxeX+eZRlLq1qfa4sgM0RLw9ZaBQ4CM4ptSk1LccaPIG+W/6PXXbjO1OOTYCwMDfRV CRGj9kZrM3OB3FNmGmeC+DbqWgDkG+3VbAJDowx3yUBOoci7xjcIUrVv21tQ=
X-Google-Smtp-Source: APXvYqxVr44fAO/vZ8V05rhw9Ft6A/eNjrGeTxJUxhnZXKKZN+H0eH5UPeE/j4Umro9UwJrSY0KwpA==
X-Received: by 2002:a65:63cb:: with SMTP id n11mr3087312pgv.236.1556791390524; Thu, 02 May 2019 03:03:10 -0700 (PDT)
Received: from ShokonoMacBook.local (M111108027067.v4.enabler.ne.jp. [111.108.27.67]) by smtp.gmail.com with ESMTPSA id a80sm78927889pfj.61.2019.05.02.03.03.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 May 2019 03:03:09 -0700 (PDT)
To: Michael Scott <mike.scott@miracl.com>
Cc: CFRG <cfrg@irtf.org>
References: <155231848866.23086.9976784460361189399@ietfa.amsl.com> <737ea2b3-74e3-d02e-a44d-c44cca5db036@lepidum.co.jp> <CAEseHRrSiJ72tQepyTiL=pSBcRRLGXhnJyy_QzOubWax+v=Ntw@mail.gmail.com> <CAEseHRqh4d0VaeSaj4CWr_ZxJbbpm33ZaLF-aYGBjVowFNLFeQ@mail.gmail.com> <c57bbf7b-3177-eb64-a3c0-26842fccbb89@lepidum.co.jp> <CAEseHRrVomCo6KD7gidCRBzKJDzFZRQ+q0+PjfBr8tQT4dVpMQ@mail.gmail.com> <b016d1f6-68e4-9728-c738-ab72c593dfd1@lepidum.co.jp> <CAEseHRoLGFbf74HT9n2beryc9Liqf2Hz+_rh-yo6Q8hNqwCvNQ@mail.gmail.com> <17e2c039-3c20-21a6-0201-4278c988c060@lepidum.co.jp> <CAEseHRp0ALe9Wc9VCNNNwgF=jhgC7TTy=eZx60Mz8fJ-H6wCXA@mail.gmail.com> <CAEseHRpSc4N+TWb-=wyauU3SJY4t56L2WeKSxgX3T0eK3SkaHg@mail.gmail.com> <04141723-2541-4bdd-04a3-c4ff364773e9@lepidum.co.jp> <CAEseHRpWYLoPd7QoHSuQPK-JKvW9BqpK3jM3jY7Yiz46THU48Q@mail.gmail.com> <CAEseHRpRRarcp_yJFGofvqq9fHZTpvkEmsg8ywx+anskPvRinQ@mail.gmail.com>
From: Shoko YONEZAWA <yonezawa@lepidum.co.jp>
Message-ID: <c1bac4f3-207e-0b8a-e16d-5c3e4a664f41@lepidum.co.jp>
Date: Thu, 02 May 2019 19:03:06 +0900
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.6.1
MIME-Version: 1.0
In-Reply-To: <CAEseHRpRRarcp_yJFGofvqq9fHZTpvkEmsg8ywx+anskPvRinQ@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/BsUWD93YZLiEHRnGZvpmValsUro>
Subject: Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-friendly-curves-01.txt
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 02 May 2019 10:03:14 -0000
Hello Mike, Thank you for your consideration. Another reason why we chose BN462 with 2+sqrt(-1) is that most of the former BN curves were D type and we would like to follow them. We would be grateful if we could proceed with BN462 described in the current version of our draft. Best, Shoko On 2019/05/02 17:34, Michael Scott wrote: > Hello Shoko, > > Just to clarify what is going on here with the BN462 curve.. > > By choosing the QNR as 1+sqrt(-1), the curve is M type, and F_p^2 > arithmetic will be quite fast, but M type twists require a bit more work. > > By choosing the QNR as 2+sqrt(-1) (as in your draft), the curve is D > type, with slower F_p^2 arithmetic, but faster twisting. > > So its depends on which optimization is regarded as more important. I > would still prefer to go with the M type, but really it makes little > difference. A common approach seems to be to support all QNRs of the > form 2^i+sqrt(-1), with minimal i. > > So basically I am withdrawing my objection to the way in which BN462 has > been presented in your draft. > > Mike > > On Mon, Apr 22, 2019 at 2:46 PM Michael Scott <mike.scott@miracl.com > <mailto:mike.scott@miracl.com>> wrote: > > (Re-sending as this thread has bloated to over 40k bytes) > > Hello Shoko, > > And thanks for your reply. I am OK with the choice of parameters for > the BLS381 curve. > > For the BN462 curve it would be a pity to use a suboptimal > representation, when a better representation is possible. For > example in https://eprint.iacr.org/2017/334.pdf , all the suggested > curves use the simpler form, as it offers "the best possible > arithmetic", including the original BN462 suggested curve. > > Maybe, as you suggest, a choice of parameters would be a solution > (or some guidance on how to switch between representations) > > Mike > > On Mon, Apr 22, 2019 at 12:26 PM Shoko YONEZAWA > <yonezawa@lepidum.co.jp <mailto:yonezawa@lepidum.co.jp>> wrote: > > Hello Mike, > > I'm sorry for being late for responding to your comments, > all of which are important and valuable. > Please allow me to reply to all of your comments in this single > mail. > > Thank you for your suggestions of the curve parameters. > As you mentioned, there are the curve parameters which provide more > efficient computation than we described, > but we emphasize the implementation status, that is, > whether the curves have been already available. > > As for BN462, we refer to the parameters implemented in mcl > (https://github.com/herumi/mcl). > In this implementation, the twisted curve is set to E':y^2=x^3-u+2 > and the tower of extension field is F_p6 = F_p2[v] / (v^3 - u - 2). > Their implementation of BLS12-381 has been adopted to Zcash > and we cannot ignore the curve parameters chosen in mcl. > Therefore, we would like to choose the existing curve parameters > in our > draft in order for interoperability. > > We understand that the parameters you suggested can indeed > improve the > efficiency. > We can add these parameters to our draft if it is accepted to > describe > multiple parameters. > > I would be grateful if my answers could make sense. > > Best, > Shoko > > On 2019/04/03 18:08, Michael Scott wrote: > > .. as a follow up to my comments on the curve BN462.. > > > > I note this choice > > > > F_p6 = F_p2[v] / (v^3 - u - 2) > > > > > > Its not clear to me why you did not choose the simpler > irreducible > > polynomial > > > > x^6-(1+sqrt(-1)) > > > > which will always be more efficient. See the section on "BN > towers" in > > https://eprint.iacr.org/2009/556.pdf > > > > where the conditions for this choice are satisfied. > > > > – If x0 ≡ 7 or 11 mod 12 then x^6 − (1 + √ −1) is > irreducible over > > Fp2 = Fp( √ −1). > > > > (in the case of BN462 x0=7 mod 12) > > > > Mike > > > > > > On Sun, Mar 31, 2019 at 8:28 PM Michael Scott > <mike.scott@miracl.com <mailto:mike.scott@miracl.com> > > <mailto:mike.scott@miracl.com > <mailto:mike.scott@miracl.com>>> wrote: > > > > Hello Shoko, > > > > Thanks for previous clarifications. > > > > I am a bit puzzled by the proposed BN462 curve > > > > You chose the curve E:y^2=x^3+5 > > On the twisted curve you choose E':y^2=x^3-u+2 (and I am > unclear > > where -u+2 came from) > > > > In the paper that first suggested the curve - > > https://eprint.iacr.org/2017/334.pdf > > > > the authors suggest > > E: y^2=x^3-4, and > > E': y^2=x^3-4(1+u) > > > > which seems simpler, and closer to the BLS381 approach > > > > I am attempting to implement these curves (and already > have BLS381 > > done). Any help is much appreciated. > > > > Mike > > > -- Shoko YONEZAWA Lepidum Co. Ltd. yonezawa@lepidum.co.jp TEL: +81-3-6276-5103
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Marek Jankowski
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- [Cfrg] Fwd: I-D Action: draft-yonezawa-pairing-fr… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… David Wong
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Paterson Kenneth
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… John Mattsson
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Marek Jankowski
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Dan Brown
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… John Mattsson
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… denis bider
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Peter Gutmann
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Peter Gutmann
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Björn Haase
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Peter Gutmann
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… William Whyte
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Watson Ladd
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Watson Ladd
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… John Mattsson
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Damien Miller
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Peter Gutmann
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Ruslan Kiyanchuk
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… mcgrew
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Paterson Kenneth
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… mcgrew
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Peter Gutmann
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… A. Huelsing
- Re: [Cfrg] I-D Action: draft-yonezawa-pairing-fri… Paul Hoffman
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Salz, Rich
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Blumenthal, Uri - 0553 - MITLL
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Paterson Kenneth
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Shoko YONEZAWA
- Re: [Cfrg] Fwd: I-D Action: draft-yonezawa-pairin… Michael Scott