Note on families of pairing-friendly elliptic curves with small embedding degree

TL;DR

This paper investigates the existence of ideal families of pairing-friendly elliptic curves with small embedding degrees, proving nonexistence for certain degrees and analyzing the ideality of others.

Contribution

It provides new theoretical results showing the nonexistence of ideal families with embedding degrees 3, 4, or 6, and examines the nonideality of many families with degrees 8 or 12.

Findings

No ideal families with embedding degree 3, 4, or 6 exist.

Many families with embedding degree 8 or 12 are nonideal.

The known ideal family with rho-value 1 is unique.

Abstract

Pairing-based cryptographic schemes require so-called pairing-friendly elliptic curves, which have special properties. The set of pairing-friendly elliptic curves that are generated by given polynomials form a complete family. Although a complete family with a $\rho$-value of 1 is the ideal case, there is only one such example that is known, this was given by Barreto and Naehrig. We prove that there are no ideal families with embedding degree 3, 4, or 6 and that many complete families with embedding degree 8 or 12 are nonideal, even if we chose noncyclotomic families.