2
$\begingroup$

I'm trying to understand which benefits can using of extension fields in elliptic curve cryptography bring over prime fields. Popular curves like secp256k1, curve25519, secp384r1 are defined over a prime field. Are there any useful elliptic curves over extension fields and what are their usecases?

$\endgroup$
2
  • 1
    $\begingroup$ Well, one has to study extension fields for the binary curves, and ternary curves, which are less secure than large prime curves. Besides, Algebraic varieties are always studied over the algebraic closure, see the Curve25519 paper. Besides, see this answer about non-prime fields; Why are elliptic curves over binary fields used less than those over prime fields $\endgroup$
    – kelalaka
    Oct 15, 2023 at 6:31
  • $\begingroup$ I disagree, generally speaking, with the statement that binary curves or ternary curves are “less secure” than elliptic curves defined over large prime fields of similar size. There are ways to mess up the parameter selection for sure, but that's true of the prime field setting as well. $\endgroup$ Oct 16, 2023 at 9:10

2 Answers 2

5
$\begingroup$

An important use case for elliptic curves over extension fields is in the area of pairing-based cryptography. Certain families of curves over extension fields give efficient constructions for cryptographic bilinear pairings, such as the Weil or Tate pairings. These primitives in turn have uses such as

$\endgroup$
4
$\begingroup$

Aside from the setting of pairing-based cryptography mentioned by @Daniel S., people may want to choose curves over extension fields for plain ECDLP-based schemes for performance reasons.

  1. Curves over binary fields tend to be easier to implemented in hardware compared to their prime field counterparts. In software, the picture is less clear and depends on the particular CPU architecture, but since the advent of carry-less multipliers on most mainstream CPUs, there have been a number of record-breaking software implementations in software as well (see e.g. Oliveira et al.'s CHES 2013 paper). I don't know if the comparison has been revisited recently taking modern vector units into account. There is one operation, in any case, for which binary curves are categorically faster than prime field ones even in software: hashing to a curve point. This makes them unbeatable in settings like the Elliptic Curve Multiset Hash that involve lots of hashing to points and few scalar multiplications.

  2. Curves over low-degree extensions of large prime fields: the selling point here is usually the existence of interesting endomorphisms that speed up scalar multiplication. A modern incarnation of this idea is Costello and Longa's Four$\mathbb{Q}$ curve (profanity definitely intended). It is a small miracle that this curve exists at all, but it allows for much faster arithmetic than the likes of Curve25519.

  3. Curves over medium-degree extensions of medium-size prime fields: there was a fair amount of research on this around 20 years ago under the moniker “optimal extension fields”. The idea was to have fast field and curve arithmetic by ensuring that field elements are represented as polynomials with coefficients fitting in a single machine word. The idea was recently revisited by Pornin in his EcGFp5 paper with interesting results. The goal there was to obtain a curve whose arithmetic could be efficiently represented in the language of certain non-interactive zero-knowledge proof systems.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.