Re: [CFRG] Asking the advice on the draft of pairing-friendly curves

[Michael Scott <[e-mail]>]

 I would like to voice my strong support for this effort.

Since pairings arrived as a new cryptographic tool in the year 2000, they
have transformed cryptography and flung open may new doors to new avenues
of research. If RSA was a cryptographic lump hammer, pairings are a Swiss
army knife.

Alternative technologies have followed behind, some of them post-quantum
secure, but they have not as yet filled many of the niches currently
occupied by pairings.

A good example of an application area would be Functional encryption, which
I mention because an email popped into my Inbox just yesterday concerning
an interesting event associated with the Real World crypto conference in
January – see https://cryptohackathon.eu/

It needs to be recognised that for reasons not entirely clear to me, many
regard pairings with suspicion. They have a largely undeserved reputation
of being slow. Many papers seem to like to boast that their scheme works
“without pairings”, as some kind of badge of honour. In fact pairing-based
schemes are completely practical.

More seriously their security has been called into question, due to some
impressive cryptanalysis. I must admit I was surprised and deeply impressed
when pairings based on small characteristic super-singular curves were
spectacularly blown out of the water. I was also impressed, although much
less surprised, when methods were found to exploit the particular form of
discrete log problem that arises in the context of large characteristic
non-supersingular pairing-friendly curves. This has lead to the adoption of
modest increases in parameter sizes.

However I would regard this as a natural progression for any new
cryptographic primitive. Parameter sizes generally creep up over time as
cryptanalytic efforts intensify, before eventually stabilising. Remember
512-bit RSA keys. Observe the current post-quantum crypto scene.

I would suggest that the security of pairings is comparable with that of
other discrete log based systems, and some 20 years after their arrival on
the cryptographic scene it is certainly time that their power was
recognised, and that standard curves should emerge for implementers to work
with in confidence. The world urgently needs better cryptography.

Hopefully CFRG will not be found wanting in offering its support for these
efforts. Personally I have always found the proposers of this standard to
be unfailingly polite and responsive to my feedback.

If de facto standards that have not undergone proper community scrutiny
start to emerge (as industry implementers lose patience waiting for
“proper” standards), then, well, that would be a pity.


Mike Scott