Re: [Cfrg] I-D Action: draft-irtf-cfrg-pairing-friendly-curves-04.txt

[Armando Faz <[e-mail]>]

Hi, I would like to give some feedback to the pairing-friendly-curves
draft-v04. Hope this helps to improve the document.

I am concerned about the security levels currently claimed. Before 2016,
everybody agreed that BN256 provided 128-bit security, after the
improvements on NFS the security level was reduced. So, what would happen
in the future when another improvement is discovered? Is there some
escalation plan for anticipating this event?

As there isn't a recommendation of curves at 192-bit level, so at the point
when moving from 128- to the 256-bit level, the change would be dramatic. I
think some curves should be recommended, even though they are not widely
used currently.

Does the curves proposed satisfy the notion of subgroup security (
https://eprint.iacr.org/2015/247)? I think some comments should be added
regarding this notion.

Have you considered the use of other models such as Hessian curves (
https://eprint.iacr.org/2018/1026). ? They are interesting since they
provide fast pairings for odd embedding degrees.

What is the isomorphism used in each instance?
## When implementing the line function, implementers should consider the
isomorphism of E and its twisted curve E' so that one can reduce the
computational cost of operations in G_2.  We note that Line_function does
not consider such isomorphism

The description of pairing computation doesn't describe the outcome of the
special cases, e.g. when points do not belong to G1 or G2, or when the
input points are the identity. (I consider this is important for
implementers not familiar with pairings.)


Editorial:

Soluti\ons -> Solutions

Better to use k for denoting a scalar, in
## Similarly, we can define 2P = P + P and a scalar multiplication S = [k]P
for a positive integer k can be defined as an (k-1)-time addition of P.

T belongs to E'
## Similarly, for any S in G_1, e(S, T) = 1 if and only if T = O_E'

reducedto -> reduced to

In the description of ate pairing computation, there is an inconsistency
between the number of inputs of the Line_function.

-- 
Armando Faz
Cloudflare Inc.