1
$\begingroup$

According to domain parameters, as an example Type 1 pairing domain parameters are

type a
q 27879613696961117336138104309456294826479066237082592266147038816013737491804164520572553699557553630981482283688199917967118528442239571468038223146350512716655640686574646971805525067560602493473605950050724367056555427793982219494494533985075071293605883935405449574693139267144620339147780011932034570971
r 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503566337
h 
4158713168123445580277356330123491616648662731352560789333036543154928645632846280639115948806843941261964661880479762215130625902691650289531941682715356
exp1 19
exp2 511
sign0 1
sign1 1

How can we define the order of system parameters?
Order for generator $P\in\mathbb{G}_1$?
Order of random secret key $s$ from $Zr$?

Improve this question
$\endgroup$
1
  • $\begingroup$ Not entirely sure what you're asking here. This is a "Type A" supersingular curve according to the dichotomy presented in Benn Lynn's thesis. We have $E(\mathbb{F}_q) : y^2 = x^3 + x$, where $\mathbb{G}_1 = \mathbb{G}_2 = E(\mathbb{F}_q)[r]$ and $\mathbb{G}_T$ is the subgroup of $r$th roots of unity of $\mathbb{F}_{q^2}^\ast$. Here $r = 2^{511} + 2^{19} + 1$. So $r$ is the order of the elements of $\mathbb{G}_1, \mathbb{G}_2,$ and $\mathbb{G}_T$. $\endgroup$
    – Samuel Neves
    Jul 3, 2016 at 10:01

1 Answer 1

Reset to default
1
$\begingroup$

I think you should probably specify more details about the current curve, or give more insight about the parameters you are choosing, eg: is this a curve over $GF(p)$ or is this a curve over $GF(2^m)$. What is your $r$ value? Without such detail I can't give a very accurate answer but the order of the subgroup generated by a given point $P$, $<P>$ can be calculated from a combination of bruteforcing and checking the divisors of the number of elements inside the original curve (Since these are cyclic groups you really only need to apply lagrange theorem and check if the current divisor $d$ of $n$ satisfies $P^d = O$). There are polynomial time algorithms to retrieve the order of the original curve group (check Schoof's algorithm).

Improve this answer
$\endgroup$
1
  • $\begingroup$ JOÃO MARQUES. Pairings are constructed on the curve y2 = x3 + x over the field F_q for some prime q = 3 mod 4. Both G1 and G2 are the group of points E(F_q), so this pairing is symmetric. It turns out #E(F_q) = q + 1 and #E(F_q2) = (q + 1)2. Thus the embedding degree k is 2, and hence GT is a subgroup of F_q^2. The order r is some prime factor of q + 1. Write q + 1 = r * h. For efficiency, r is picked to be a Solinas prime, that is, r has the form 2a +- 2b +- 1 for some integers 0 < b < a. $\endgroup$
    – mimi
    Mar 4, 2016 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.