Jpbc secure choice of elliptic curve

Question

JPBC library describes 6 types of elliptic curves. This is how they describe type A:

Type A pairings are constructed on the curve $y^2=x^3+x$ over the field $\mathbb{F}_q$ for some prime $q=3 \mod 4$ . Both $\mathbb{G}_1$ and $\mathbb{G}_2$ are the group of points $E(\mathbb{F}_q)$ , so this pairing is symmetric. The order $r$ is some prime factor of $q+1$ .

They also offer a curve generator implementation that takes in rBits and qBits values and calculates the q,r,h, exp1, exp2 values.

I would like to know, what rBits and qBits values consider to be secure enough for cryptocurrency wallet security? Also, what is the best type that provides the mentioned security and has the best performance?

I recently implemented BLS signature aggregation using JPBC, and I would like to know what would be the best settings to use in cryptocurrency application that will use it?

Answer 1

Since $\mathbb{G}_T$ is $\mathbb{F}_{q^2}$ in the setting you are mentioning, you would have to choose them so large that your implementation will no longer have the performance one would hope for.

I would recommend to switch to the asymmetric setting. Currently the probably best choice regarding performance and existence of optimised implementations is to use BN parings. However, recent progress in solving the discrete log problem in prime extension fields suggests that BLS curves might be an even better choice (see here). In the aforementioned paper you can also find estimations on the impact of the recent improvements on the key length. For BN pairings these estimations suggest that it is required to increase the bit length of $p$ to 461 bit for 128 bit security. There is also an alternative estimation which suggests that it is sufficient to use $p$ of length 383 bits for 128 bit security. The conservative choice would thus be 461 bit.

I would probably also use another library - as far as I know JPBC is not the best choice regarding performance. There are various Java implementations for BN pairings available. One option would be to rely on the bnpairings library. Another option would be to go for the ECCelerate library, which is free for educational and research purposes, and also provides a very recent and highly optimised implementation of BN pairings. Since you mentioned that you implemented BLS signatures: it might also be interesting for you that ECCelerate already offers means to hash to the groups as required by BLS signatures. I don't know whether this is implemented in the BNpairings library.