Elliptic Curves Suitable for Pairing Based Cryptography

• Authors: Friederike Brezing;Annegret Weng
• Venue: Designs, Codes and Cryptography
• Year: 2005

For pairing based cryptography we need elliptic curves defined over finite fields$$\mathbb{F}_{q}$$ whose group order is divisible by some prime$$\ell$$ with$$\ell | q^{k-1}$$ where k is relatively small. In Barreto et al. and Dupont et al. [Proceedings of the Third Workshop on Security in Communication Networks (SCN 2002), LNCS, 2576, 2003; Building curves with arbitrary small Mov degree over finite fields, Preprint, 2002], algorithms for the construction of ordinary elliptic curves over prime fields$$\mathbb{F}_{p}$$ with arbitrary embedding degree k are given. Unfortunately, p is of size$$O(\ell^{2})$$.We give a method to generate ordinary elliptic curves over prime fields with p significantly less than$$\ell^{2}$$ which also works for arbitrary k. For a fixed embedding degree k, the new algorithm yields curves with$$p \approx \ell^{s}$$ where$$s = 2 - 2/\varphi(k)$$ or$$s = 2 - 1/\varphi(k)$$ depending on k. For special values of k even better results are obtained.We present several examples. In particular, we found some curves where$$\ell$$ is a prime of small Hamming weight resp. with a small addition chain.