We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more inefficient would a pairing computation on this curve be compared to a BN curve?


1 Answer 1


The embedding degree specifies how many times bigger the finite-field you map to is compared to the field the curve is defined over.

For example for BN(2,254) the degree is 12, mapping to a 3000 bit field, which matches the security level of the curve (~128 bits of security for both) and is reasonably efficient (you can perform a couple of hundred exponentiations per second in this field).

For Curve25519 the degree is 1206167596222043702328864427173832373476186059896651267666991823047575708498 $\approx 10^{75}$, mapping to a $\approx 3 \cdot10^{75}$ bit field. It's rather unlikely that you could afford a computer which can store an element of this field or perform computations on it.


  • $\begingroup$ wouldn't change much but it should be $\approx 3 \cdot 10^{77}$ (not $75$), or? $\endgroup$
    – J. Doe
    Commented Mar 5, 2021 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.