We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more inefficient would a pairing computation on this curve be compared to a BN curve?
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
The embedding degree specifies how many times bigger the finite-field you map to is compared to the field the curve is defined over.
For example for BN(2,254) the degree is 12, mapping to a 3000 bit field, which matches the security level of the curve (~128 bits of security for both) and is reasonably efficient (you can perform a couple of hundred exponentiations per second in this field).
For Curve25519 the degree is 1206167596222043702328864427173832373476186059896651267666991823047575708498 $\approx 10^{75}$, mapping to a $\approx 3 \cdot10^{75}$ bit field. It's rather unlikely that you could afford a computer which can store an element of this field or perform computations on it.
answered Jul 25, 2017 at 21:47
-
$\begingroup$ wouldn't change much but it should be $\approx 3 \cdot 10^{77}$ (not $75$), or? $\endgroup$– J. DoeCommented Mar 5, 2021 at 12:22