Re: [CFRG] Asking the advice on the draft of pairing-friendly curves

[Yumi Sakemi <[e-mail]>]

Dear Prof. Scott

Thank you for your encouraging message!!
We are very grateful for your support of our activities.

In addition, we glad to know your strong motivation about the pairing
technologies.
We will proceed to meet your expectations.

Best regards,
Yumi

2020年12月23日(水) 23:04 Michael Scott <[e-mail]>:
>
>  I would like to voice my strong support for this effort.
>
> Since pairings arrived as a new cryptographic tool in the year 2000, they have transformed cryptography and flung open may new doors to new avenues of research. If RSA was a cryptographic lump hammer, pairings are a Swiss army knife.
>
> Alternative technologies have followed behind, some of them post-quantum secure, but they have not as yet filled many of the niches currently occupied by pairings.
>
> A good example of an application area would be Functional encryption, which I mention because an email popped into my Inbox just yesterday concerning an interesting event associated with the Real World crypto conference in January – see https://cryptohackathon.eu/
>
> It needs to be recognised that for reasons not entirely clear to me, many regard pairings with suspicion. They have a largely undeserved reputation of being slow. Many papers seem to like to boast that their scheme works “without pairings”, as some kind of badge of honour. In fact pairing-based schemes are completely practical.
>
> More seriously their security has been called into question, due to some impressive cryptanalysis. I must admit I was surprised and deeply impressed when pairings based on small characteristic super-singular curves were spectacularly blown out of the water. I was also impressed, although much less surprised, when methods were found to exploit the particular form of discrete log problem that arises in the context of large characteristic non-supersingular pairing-friendly curves. This has lead to the adoption of modest increases in parameter sizes.
>
> However I would regard this as a natural progression for any new cryptographic primitive. Parameter sizes generally creep up over time as cryptanalytic efforts intensify, before eventually stabilising. Remember 512-bit RSA keys. Observe the current post-quantum crypto scene.
>
> I would suggest that the security of pairings is comparable with that of other discrete log based systems, and some 20 years after their arrival on the cryptographic scene it is certainly time that their power was recognised, and that standard curves should emerge for implementers to work with in confidence. The world urgently needs better cryptography.
>
> Hopefully CFRG will not be found wanting in offering its support for these efforts. Personally I have always found the proposers of this standard to be unfailingly polite and responsive to my feedback.
>
> If de facto standards that have not undergone proper community scrutiny start to emerge (as industry implementers lose patience waiting for “proper” standards), then, well, that would be a pity.
>
>
> Mike Scott
>
>


-- 
Yumi Sakemi, Ph. D.
Lepidum Co. Ltd.

E-Mail: [e-mail]