Implementing cryptographic pairings at standard security levels

TL;DR

This paper demonstrates efficient implementation of cryptographic pairings at standard security levels, identifying suitable curves and algorithms for optimal performance in cryptographic applications.

Contribution

It provides a comprehensive implementation framework for cryptographic pairings, including curve selection, algorithm optimization, and security level recommendations.

Findings

Existence of optimal ate and twisted ate pairings for various security levels

Efficient evaluation methods for pairings using Miller's algorithm and addition-subtraction chains

Guidelines for selecting appropriate curves and pairings for different security requirements

Abstract

This study reports on an implementation of cryptographic pairings in a general purpose computer algebra system. For security levels equivalent to the different AES flavours, we exhibit suitable curves in parametric families and show that optimal ate and twisted ate pairings exist and can be efficiently evaluated. We provide a correct description of Miller's algorithm for signed binary expansions such as the NAF and extend a recent variant due to Boxall et al. to addition-subtraction chains. We analyse and compare several algorithms proposed in the literature for the final exponentiation. Finally, we ive recommendations on which curve and pairing to choose at each security level.