Re: [Cfrg] Call for adoption: draft-yonezawa-pairing-friendly-curves

Dear Riad, Kobi

This is Tsunekazu SAITO.

I also think that it is very important to decide which curve is listed and which is not listed, 
as Riad and Kobi say. We also investigated the implementation of pairing.
There are a large number of pairing implementations:

URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vRhMzGruI5BU3ovp-83CbwG9yrmaU6XIweXv_-0uS3Kl_KUSmPLpmNJzU7mpUwqq-ysKJHSMMRABhU-/pubhtml?gid=1569286446&single=true

At IETF105, Shoko talked in detail about the significance of this draft for pairing, 
here I would like to explain the reasons for selecting the curves listed above.

(1) One reason is because the curve is widely used and is expected to be used in the future. 
Therefore, the BLS12-381 curve originally is cited and selected in the draft of BLS signature and HashingToCruve. 
Furthermore, I think that there is a possibility that it may be used in a signature ECDAA in TCG that is very similar to the BLS signature. 

(2) As the 2nd reason, the curve is selected so that it can be changed 
as smoothly as possible from the parameter BN254 etc. that have been used before. 
If one implemented BN254 curve, the cost of chaning from BN254 to BN462 can be reduced. 
Therfore, BN462 is listed. 

Therefore, we selected the two parameters, BLS12-381 and BN462, for describing 128-bit secure parameters. 
If there will be a curve that matches these reason and has strong influence 
for some protocol in the future, we should describe the detail parameter of the curve under many hum. 
On the other hand, it is very important to decide whether or not to publish for the rapid progress of the draft.

Of course, other curves such as BLS12-377 will be included in the usage list.

Best Regards,
Tsunekazu 

From: Kobi Gurkan <kobigurk@gmail.com> 
Sent: Wednesday, September 11, 2019 7:47 PM
To: Riad S. Wahby <rsw@jfet.org>
Cc: Paterson Kenneth <kenny.paterson@inf.ethz.ch>; cfrg@ietf.org; draft-yonezawa-pairing-friendly-curves.authors@ietf.org; cfrg-chairs@ietf.org
Subject: Re: [Cfrg] Call for adoption: draft-yonezawa-pairing-friendly-curves

Riad makes a good point. Maybe a SNARK-specific draft could be a better place.

On Mon, Sep 9, 2019 at 8:04 AM Riad S. Wahby <mailto:rsw@jfet.org> wrote:
Paterson  Kenneth <mailto:kenny.paterson@inf.ethz.ch> wrote:
> https://datatracker.ietf.org/doc/draft-yonezawa-pairing-friendly-curves/
>
> Please give your views on whether this document should be adopted
> as a CFRG draft, and if so, whether you'd be willing to help work
> on it/review it.

I support adoption of this draft, and I'm happy to help review it
and to make sure it's well synchronized with the hash-to-curve and
BLS signatures efforts (just as Armando has already said).

But I am a bit wary about mission creep. In particular I think we
should want pretty strong justification before adding specialized
constructions like the ZEXE curves and the Coda cycle. I'd prefer
for those to live in their own document(s) since probably they're
unnecessary (and add needless cost) for most applications.

-=rsw

_______________________________________________
Cfrg mailing list
mailto:Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg