On cycles of pairing-friendly elliptic curves

TL;DR

This paper investigates cycles of pairing-friendly elliptic curves, constructing a specific cycle of length 4 with MNT curves, and establishing limitations on cycle lengths and compositions for cryptographic applications.

Contribution

It constructs a new length-4 cycle of MNT pairing-friendly elliptic curves and characterizes all possible MNT cycles, also proving non-existence results for certain cycle types.

Findings

Constructed a length-4 cycle of MNT curves.

Ruled out cycles of length 2 for small embedding degrees.

Proved that long cycles cannot be formed from curves with the same CM discriminant.

Abstract

A cycle of elliptic curves is a list of elliptic curves over finite fields such that the number of points on one curve is equal to the size of the field of definition of the next, in a cyclic way. We study cycles of elliptic curves in which every curve is pairing-friendly. These have recently found notable applications in pairing-based cryptography, for instance in improving the scalability of distributed ledger technologies. We construct a new cycle of length 4 consisting of MNT curves, and characterize all the possibilities for cycles consisting of MNT curves. We rule out cycles of length 2 for particular choices of small embedding degrees. We show that long cycles cannot be constructed from families of curves with the same complex multiplication discriminant, and that cycles of composite order elliptic curves cannot exist. We show that there are no cycles consisting of curves from only the Freeman or Barreto--Naehrig families.