According to domain parameters, as an example Type 1 pairing domain parameters are

type a
q 27879613696961117336138104309456294826479066237082592266147038816013737491804164520572553699557553630981482283688199917967118528442239571468038223146350512716655640686574646971805525067560602493473605950050724367056555427793982219494494533985075071293605883935405449574693139267144620339147780011932034570971
r 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503566337
exp1 19
exp2 511
sign0 1
sign1 1

How can we define the order of system parameters?
Order for generator $P\in\mathbb{G}_1$?
Order of random secret key $s$ from $Zr$?

  • $\begingroup$ Not entirely sure what you're asking here. This is a "Type A" supersingular curve according to the dichotomy presented in Benn Lynn's thesis. We have $E(\mathbb{F}_q) : y^2 = x^3 + x$, where $\mathbb{G}_1 = \mathbb{G}_2 = E(\mathbb{F}_q)[r]$ and $\mathbb{G}_T$ is the subgroup of $r$th roots of unity of $\mathbb{F}_{q^2}^\ast$. Here $r = 2^{511} + 2^{19} + 1$. So $r$ is the order of the elements of $\mathbb{G}_1, \mathbb{G}_2,$ and $\mathbb{G}_T$. $\endgroup$ – Samuel Neves Jul 3 '16 at 10:01

I think you should probably specify more details about the current curve, or give more insight about the parameters you are choosing, eg: is this a curve over $GF(p)$ or is this a curve over $GF(2^m)$. What is your $r$ value? Without such detail I can't give a very accurate answer but the order of the subgroup generated by a given point $P$, $<P>$ can be calculated from a combination of bruteforcing and checking the divisors of the number of elements inside the original curve (Since these are cyclic groups you really only need to apply lagrange theorem and check if the current divisor $d$ of $n$ satisfies $P^d = O$). There are polynomial time algorithms to retrieve the order of the original curve group (check Schoof's algorithm).

| improve this answer | |
  • $\begingroup$ JOÃO MARQUES. Pairings are constructed on the curve y2 = x3 + x over the field F_q for some prime q = 3 mod 4. Both G1 and G2 are the group of points E(F_q), so this pairing is symmetric. It turns out #E(F_q) = q + 1 and #E(F_q2) = (q + 1)2. Thus the embedding degree k is 2, and hence GT is a subgroup of F_q^2. The order r is some prime factor of q + 1. Write q + 1 = r * h. For efficiency, r is picked to be a Solinas prime, that is, r has the form 2a +- 2b +- 1 for some integers 0 < b < a. $\endgroup$ – mimi Mar 4 '16 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.