As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing.

I am curious whether I should care which type of pairing I am using in my implementations? Do they affect performance or security at all?

What should I know about these types?

So far, I think I've got these points:

  1. There is an obvious and serious difference between different types of "Curve Generation" in pairings. I mean, whether they are Super Singular, MNT curves, Cocks-Pinch, Barreto-Naehrig, etc is really important because it affects the "security multiplier" (i.e. embedding rate). And for a certain security parameter higher embedding rate means better performance and shorter representation of elements of $G_1$.
  2. Also it is important whether the curves are over "large prime fields" or over fields of "small characteristic" because recent research works in cryptanalysis of elliptic curves show that elliptic curves over fields of small characteristic are not secure anymore.
  • $\begingroup$ On number 2, can you give a citation? I know there has been work that broke the DL problem for finite fields of small characteristic, but that work doesn't apply to ECDLP. $\endgroup$
    – pg1989
    Nov 9, 2014 at 23:00
  • 1
    $\begingroup$ @pg1989, I cite the blog post by Steven Galbraith who is, to my knowledge, one of the most well-known researchers in the topic of Elliptic Curves. He apparently indicates that the curves on small characteristics are dead and so the the Type-I pairings because these pairings on fields of large primes are practically inefficient. $\endgroup$
    – Habib
    Nov 10, 2014 at 10:38
  • $\begingroup$ @pg1989, an interesting question and answer on crypto.SE related to this topic is here $\endgroup$
    – Habib
    Nov 10, 2014 at 10:40
  • $\begingroup$ I wonder is there a problem with my explanation of question or it is not a matter of interest for the majority of this website's users. I expected much more interested and experienced users in this field. I can't believe there was no answer during these days. (And... am I allowed to post this type of comments?) $\endgroup$
    – Habib
    Nov 14, 2014 at 10:59
  • $\begingroup$ In my opinion the question is too open-ended. You should ask specific questions about specific aspects of pairing implementations. Also pairings are a new and complex primitive that are still pretty niche. Also, you could ask the author of PBC this in an email. $\endgroup$
    – pg1989
    Nov 14, 2014 at 21:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.