Re: [Cfrg] I-D Action: draft-yonezawa-pairing-friendly-curves-00.txt

[Shoko YONEZAWA <[e-mail]>]

Dear Kenny,

Thank you very much for your comments on our draft.

 > One question I had at this stage: would it be feasible to include a 
short, self-contained description in pseudo-code of how to compute a 
pairing on these curves? I know this may be asking for quite a lot, 
especially as there are different pairings available, and many 
implementation optimisations can be made. However, perhaps a simple and 
not necessarily super-optimised description could be given? This would 
enable people starting from scratch with a suitable curve library to at 
least obtain a working implementation for themselves (which would of 
course be rather slow).

We are going to describe pseudo-code of pairing computation (optimal Ate 
pairing, specifically) for both BN curves and BLS curves
so that readers can imagine the implementation of pairing computation.
This will appear in Appendix.
I will post the description after we complete it.
Your comments are really appreciated.

 > Relatedly, then, it would be useful to include test vectors for this 
"reference implementation".

We are going to include test vectors as well as curve parameters (size, 
order, generator, cofactor etc.) in the next version.
One thing we are worrying is how to represent an element of an extension 
field (G2 and GT) in String.
We will try to find the suitable representation by referring other 
examples and hearing the opinions from users of these curves.

Best regards,
Shoko

On 2019/02/08 21:01, Paterson, Kenny wrote:
> Dear Shoko,
> 
> Thanks for preparing this draft. I think it could be very useful for CFRG to specify some pairing-friendly curves that reflect recent advances in cryptanalysis. We expect additional drafts making use of such curves to come before CFRG for consideration in the near future.
> 
> One question I had at this stage: would it be feasible to include a short, self-contained description in pseudo-code of how to compute a pairing on these curves? I know this may be asking for quite a lot, especially as there are different pairings available, and many implementation optimisations can be made. However, perhaps a simple and not necessarily super-optimised description could be given? This would enable people starting from scratch with a suitable curve library to at least obtain a working implementation for themselves (which would of course be rather slow). Relatedly, then, it would be useful to include test vectors for this "reference implementation".
> 
> Best wishes,
> 
> Kenny
> 
> -----Original Message-----
> From: Cfrg <[e-mail]> on behalf of Shoko YONEZAWA <[e-mail]>
> Date: Monday, 28 January 2019 at 14:55
> To: "[e-mail]" <[e-mail]>
> Subject: [Cfrg] I-D Action: draft-yonezawa-pairing-friendly-curves-00.txt
> 
>      Hi there,
>      
>      we have submitted an Internet-Draft about pairing-friendly curves.
>      This is a revision of draft-kato-threat-pairing
>      (https://datatracker.ietf.org/doc/draft-kato-threat-pairing/).
>      
>      Our I-D introduces pairing-friendly curves used for constructing
>      highly-functional crypto-based protocols.
>      We describe secure parameters for pairing-frinedly curves
>      reflecting the recent result on the remarkable attack
>      by Kim and Barbulescu.
>      
>      I would be grateful if you are interested in our draft
>      and kindly read it. Your comments are welcome.
>      
>      Thank you,
>      Shoko YONEZAWA
>      
>      ---
>      A New Internet-Draft is available from the on-line Internet-Drafts
>      directories.
>      
>      
>               Title           : Pairing-Friendly Curves
>               Authors         : Shoko Yonezawa
>                                 Sakae Chikara
>                                 Tetsutaro Kobayashi
>                                 Tsunekazu Saito
>      	Filename        : draft-yonezawa-pairing-friendly-curves-00.txt
>      	Pages           : 17
>      	Date            : 2019-01-27
>      
>      Abstract:
>          This memo introduces pairing-friendly curves used for constructing
>          pairing-based cryptography.  It describes recommended parameters for
>          each security level and recent implementations of pairing-friendly
>          curves.
>      
>      
>      The IETF datatracker status page for this draft is:
>      https://datatracker.ietf.org/doc/draft-yonezawa-pairing-friendly-curves/
>      
>      There are also htmlized versions available at:
>      https://tools.ietf.org/html/draft-yonezawa-pairing-friendly-curves-00
>      https://datatracker.ietf.org/doc/html/draft-yonezawa-pairing-friendly-curves-00
>      
>      
>      Please note that it may take a couple of minutes from the time of submission
>      until the htmlized version and diff are available at tools.ietf.org.
>      
>      Internet-Drafts are also available by anonymous FTP at:
>      ftp://ftp.ietf.org/internet-drafts/
>      
>      _______________________________________________
>      Cfrg mailing list
>      [e-mail]
>      https://www.irtf.org/mailman/listinfo/cfrg
>      
> 

-- 
Shoko YONEZAWA
Lepidum Co. Ltd.
[e-mail]
TEL: [phone]