A paper was presented at the INSCRYPT 2018 called: "Searching BN Curves for SM9"


SM9 is a Chinese National Identity Based Cryptography Standard and was originally published using a 256-bit Barreto-Naehrig Curve as its primary example. This new paper suggests that because attacks against some Barreto-Naehrig curves have improved that the SM9 standard should adopt a 384-bit Barreto-Naehrig Curve. The authors go on to suggest that this curve offers roughly 118 bits of security.

My question is whether there are more efficient curves (such as BLS or KSS curves) that offer the same security. For instance I have been told that the degree 12 BLS curve using a 381 bit prime modulus would be more efficient. If there are more efficient curves what are the most efficient for security equivalent or greater than the 384-bit Barreto-Naehrig curve?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.