Subject: Re: [Cfrg] I-D Action: draft-yonezawa-pairing-friendly-curves-00.txt

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 8 Feb 2019 12:01:32 +0000

Dear Shoko,

Thanks for preparing this draft. I think it could be very useful for CFRG to specify some pairing-friendly curves that reflect recent advances in cryptanalysis. We expect additional drafts making use of such curves to come before CFRG for consideration in the near future.

One question I had at this stage: would it be feasible to include a short, self-contained description in pseudo-code of how to compute a pairing on these curves? I know this may be asking for quite a lot, especially as there are different pairings available, and many implementation optimisations can be made. However, perhaps a simple and not necessarily super-optimised description could be given? This would enable people starting from scratch with a suitable curve library to at least obtain a working implementation for themselves (which would of course be rather slow). Relatedly, then, it would be useful to include test vectors for this "reference implementation".

Best wishes,

Kenny 

-----Original Message-----
From: Cfrg <[email-masked]> on behalf of Shoko YONEZAWA <[email-masked]>
Date: Monday, 28 January 2019 at 14:55
To: "[email-masked]" <[email-masked]>
Subject: [Cfrg] I-D Action: draft-yonezawa-pairing-friendly-curves-00.txt

    Hi there,
    
    we have submitted an Internet-Draft about pairing-friendly curves.
    This is a revision of draft-kato-threat-pairing 
    (https://datatracker.ietf.org/doc/draft-kato-threat-pairing/).
    
    Our I-D introduces pairing-friendly curves used for constructing
    highly-functional crypto-based protocols.
    We describe secure parameters for pairing-frinedly curves
    reflecting the recent result on the remarkable attack
    by Kim and Barbulescu.
    
    I would be grateful if you are interested in our draft
    and kindly read it. Your comments are welcome.
    
    Thank you,
    Shoko YONEZAWA
    
    ---
    A New Internet-Draft is available from the on-line Internet-Drafts 
    directories.

             Title           : Pairing-Friendly Curves
             Authors         : Shoko Yonezawa
                               Sakae Chikara
                               Tetsutaro Kobayashi
                               Tsunekazu Saito
    	Filename        : draft-yonezawa-pairing-friendly-curves-00.txt
    	Pages           : 17
    	Date            : 2019-01-27
    
    Abstract:
        This memo introduces pairing-friendly curves used for constructing
        pairing-based cryptography.  It describes recommended parameters for
        each security level and recent implementations of pairing-friendly
        curves.

    The IETF datatracker status page for this draft is:
    https://datatracker.ietf.org/doc/draft-yonezawa-pairing-friendly-curves/
    
    There are also htmlized versions available at:
    https://tools.ietf.org/html/draft-yonezawa-pairing-friendly-curves-00
    https://datatracker.ietf.org/doc/html/draft-yonezawa-pairing-friendly-curves-00

    Please note that it may take a couple of minutes from the time of submission
    until the htmlized version and diff are available at tools.ietf.org.
    
    Internet-Drafts are also available by anonymous FTP at:
    ftp://ftp.ietf.org/internet-drafts/
    
    _______________________________________________
    Cfrg mailing list
    [email-masked]
    https://www.irtf.org/mailman/listinfo/cfrg

---

From: Shoko YONEZAWA <[email-masked]>
Date: Fri, 15 Feb 2019 12:46:31 +0900

Dear Kenny,

Thank you very much for your comments on our draft.

 > One question I had at this stage: would it be feasible to include a 
short, self-contained description in pseudo-code of how to compute a 
pairing on these curves? I know this may be asking for quite a lot, 
especially as there are different pairings available, and many 
implementation optimisations can be made. However, perhaps a simple and 
not necessarily super-optimised description could be given? This would 
enable people starting from scratch with a suitable curve library to at 
least obtain a working implementation for themselves (which would of 
course be rather slow).

We are going to describe pseudo-code of pairing computation (optimal Ate 
pairing, specifically) for both BN curves and BLS curves
so that readers can imagine the implementation of pairing computation.
This will appear in Appendix.
I will post the description after we complete it.
Your comments are really appreciated.

 > Relatedly, then, it would be useful to include test vectors for this 
"reference implementation".

We are going to include test vectors as well as curve parameters (size, 
order, generator, cofactor etc.) in the next version.
One thing we are worrying is how to represent an element of an extension 
field (G2 and GT) in String.
We will try to find the suitable representation by referring other 
examples and hearing the opinions from users of these curves.

Best regards,
Shoko

-- 
Shoko YONEZAWA
Lepidum Co. Ltd.
[email-masked]
TEL: +81-3-6276-5103

---

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 15 Feb 2019 09:16:30 +0000

Dear Shoko,

> On 15 Feb 2019, at 03:46, Shoko YONEZAWA <[email-masked]> wrote:
> 
> Dear Kenny,
> 

[...]

> We are going to describe pseudo-code of pairing computation (optimal Ate pairing, specifically) for both BN curves and BLS curves

Excellent. 

> > Relatedly, then, it would be useful to include test vectors for this "reference implementation".
> 
> We are going to include test vectors as well as curve parameters (size, order, generator, cofactor etc.) in the next version.
> One thing we are worrying is how to represent an element of an extension field (G2 and GT) in String.
> We will try to find the suitable representation by referring other examples and hearing the opinions from users of these curves.

There are people on this list who have lots of experience of this kind of thing and I'm sure they'll jump in to help out. 

Cheers,

Kenny

---

From: Shoko YONEZAWA <[email-masked]>
Date: Fri, 15 Feb 2019 19:08:24 +0900

Dear Kenny,

 >> We are going to include test vectors as well as curve parameters 
(size, order, generator, cofactor etc.) in the next version.
 >
 > There are people on this list who have lots of experience of this 
kind of thing and I'm sure they'll jump in to help out.

Very nice to hear that. We really appreciate it.
At the moment, we would like to use the representation
according to the definition given in IEEE 1363a-2004.
I'd like to ask users if it would be acceptable.

Best regards,
Shoko

-- 
Shoko YONEZAWA
Lepidum Co. Ltd.
[email-masked]
TEL: +81-3-6276-5103