"If we use the efficient pairing groups of Pinocchio, computing discrete logarithms in the exponent field $\mathbb{F}_p$ with p ≈ 256 is easy. We could switch to non-standard and larger pairing groups, but this seems undesirable as it would bring down the overall performance of the proof system. Instead we propose to compute C in an extension field $\mathbb{F}_{p^\mu}$ of size $p^\mu$ > 2048."
Here C is just a Pedersen commitment. My question is, to achieve 128 bits of security, what should be the size of $p^\mu$? Is there any source where I can find the relevant specifications?
• $p^{\mu}$ is a generalization of the $2^m$ approach? In this case $log_2(p^{\mu})>3072$ – SEJPM May 25 '15 at 16:38
• Actually, there's been a number of recent results about quickly computing Discrete Logs in extension fields of small characteristic, such as eprint.iacr.org/2013/400.pdf . While using $\mu$ prime would appear to be immune to these results, I'd still be cautious about it. If there any particular reason why you can't use a prime field? – poncho May 25 '15 at 20:01