Re: [Cfrg] Fwd: I-D Action: draft-kasamatsu-bncurves-00.txt

[Kohei Kasamatsu <[e-mail]>]

Hi Laura,


Thank you for your comments.

> Regarding your statement in Section 6, "The elliptic curve that
> supports a bilinear map requires the hardness of solving following
> problems, since the security of pairing-based cryptographic
> primitives is based on hardness of these problems."  You then list
> the ECDLP, ECDHP, BDHP, ECDLP with auxiliary inputs.
>
> I would be hesitant to say ALL pairing-based cryptographic primitives
> are based on the hardness of those problems...perhaps it's true, but
> it's conceivable that a pairing-based scheme could be based on
> another hard problem, such as solving the isogeny problem or co-gap
> DH. (See, for example, Section 6 of "Evaluating Large Degree
> Isogenies and Applications to Pairing Based Cryptography" by Broker,
> Charles, Lauter, or "Improved algorithm for the isogeny problem for
> ordinary elliptic curves" by Galbraith & Stolbunov.)

We agree with it.
As you say, there are pairing-based cryptographic primitives based on 
the hardness of different problems from these described in our draft.

We would like to change
"The elliptic curve that supports a bilinear map requires the hardness 
of solving following problems, since the security of pairing-based 
cryptographic primitives is based on hardness of these problems."
to
"Pairing-based cryptographic primitives are often based on the
hardness of the following problems, so when the elliptic
curves from this document are used in such schemes, these problems
would apply."

Does the modification despel the concern?

Best,
Kohei KASAMATSU


(2014/01/24 3:13), Laura Hitt wrote:
> Hi Kohei,
>
> Regarding your statement in Section 6, "The elliptic curve that supports a bilinear map requires the hardness of solving following problems, since the security of pairing-based cryptographic primitives is based on hardness of these problems."  You then list the ECDLP, ECDHP, BDHP, ECDLP with auxiliary inputs.
>
> I would be hesitant to say ALL pairing-based cryptographic primitives are based on the hardness of those problems...perhaps it's true, but it's conceivable that a pairing-based scheme could be based on another hard problem, such as solving the isogeny problem or co-gap DH. (See, for example, Section 6 of "Evaluating Large Degree Isogenies and Applications to Pairing Based Cryptography" by Broker, Charles, Lauter, or "Improved algorithm for the isogeny problem for ordinary elliptic curves" by Galbraith & Stolbunov.)
>
> Best,
> Laura
>
> -----Original Message-----
> From: Cfrg [mailto:[e-mail]] On Behalf Of Kohei Kasamatsu
> Sent: Wednesday, January 22, 2014 6:04 PM
> To: [e-mail]
> Cc: [e-mail]; [e-mail]
> Subject: [Cfrg] Fwd: I-D Action: draft-kasamatsu-bncurves-00.txt
>
> Hi cfrg folks,
>
>
> Elliptic curves with a special map called a pairing allow cryptographic primitives to achieve functions or efficiency which cannot be realized by conventional mathematical tools. For example, ZSS signature is one of these primitives.
>
> We have recently submitted an I-D on Barreto-Naehrig curves (BN-curves) which provide efficient operations of a pairing.
> The I-D specifies parameters of BN-curves which are particularly useful for realization of efficient cryptographic schemes based on pairing and parameters of BN-curves which are compliant with ISO/IEC 15946-5.
>
> We will propose I-Ds on computation of pairing and pairing-based primitives in order to contribute to IETF community in the near future.
>
> We would appreciate your comments and suggestions on our I-D and works.
>
> Best,
> Kohei KASAMATSU
> -------- Original Message --------
> Subject: I-D Action: draft-kasamatsu-bncurves-00.txt
> Date: Thu, 09 Jan 2014 21:13:03 -0800
> From: [e-mail]
> Reply-To: [e-mail]
> To: [e-mail]
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>
>
>           Title           : Barreto-Naehrig Curves
>           Authors         : Kohei Kasamatsu
>                             Satoru Kanno
>                             Tetsutaro Kobayashi
>                             Yuto Kawahara
> 	Filename        : draft-kasamatsu-bncurves-00.txt
> 	Pages           : 15
> 	Date            : 2014-01-09
>
> Abstract:
>      Elliptic curves with pairing are useful tools for constructing
>      cryptographic primitives.  In this memo, we specify domain parameters
>      of Barreto-Naehrig curve (BN-curve) [5].  The BN-curve is an elliptic
>      curve suitable for pairings and allows us to achieve high security
>      and efficiency of cryptographic schemes.  This memo specifies domain
>      parameters of two 254-bit BN-curves [1] [2] which allow us to obtain
>      efficient implementations and domain parameters of 224, 256, 384, and
>      512-bit BN-curves which are compliant with ISO/IEC 15946-5[3].
>      Furthermore, this memo organizes differences between types of
>      elliptic curves specified in ISO document and often used in open
>      source softwares, which are called M-type and D-type
>      respectively[21].
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-kasamatsu-bncurves/
>
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-kasamatsu-bncurves-00
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> I-D-Announce mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> http://www.irtf.org/mailman/listinfo/cfrg
>
>


-- 
Kohei KASAMATSU

NTT Software Corporation
TEL: [phone] FAX: [phone]
E-mail: [e-mail]