# Pairing Field size as security parameter

I have read Pairings for cryptographers: It states that the groups $G_1$ and $G_2$ are groups of points on the curve and the group GT is a subgroup of the multiplicative group of a related finite field $F_{q^k}$. l is the order of these three groups. It then states that the sizes for $q$ are more comparable to RSA rather than like RCC. I implemented a type D curve. Lynn states for the type D curve that 170 bit for q (and l) should be sufficient.

I have problems to understand this all since I am missing some mathematical background. The size of q is very much depending on the type of curve. Or is Lynn's statement just outdated? When I implement a scheme based on this particular "type D"-curve, how do I define the security parameters and how do I justify my decision?

I would have thought, that the group operations in $G_1$ are the fastest and all others are slower, therefore this size matters. But now I think this is too easy and wrong.

Thats a bit outdated as for your choice of setting (with $k=6$) the 170 bit will give you 1020 bit security in the subgroup of $F_{q^6}^*$.
In your case for embedding degree 6 I would at least take 224 bits which would give you 1344 bits in the multiplicative subgroup of $F_{q^6}^*$ or you even go to 256 bits which will give you 1536 bits. Anyways the setting with embedding degree 6 will give you not an optimal efficiency-security tradeoff as you have to take far higher security levels in the curve to achieve acceptable security levels in $G_T$.
The choice of Baretto-Naehrig curves will give you the optimum security-efficiency tradeoff (they have $k=12$) today and they are for instance implemented in the RELIC toolkit.