Constructing Abelian Varieties for Pairing-Based Cryptography

26 Pages·2008·0.28 MB·English

by  David Freeman

AbelianVarietiesandPairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1
ConstructingPairing-FriendlyAbelianVarieties:Method2
Constructing Abelian Varieties for
Pairing-Based Cryptography
David Freeman
StanfordUniversity,USA
Foundations of Computational Mathematics:
Workshop on Computational Number Theory
24 June 2008
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
What is pairing-based cryptography?
“Pairing-based cryptography” refers to protocols that use a
nondegenerate, bilinear map
e : G ×G → G
1 2 T
between finite, cyclic groups.
Need discrete logarithm problem (DLP) in G ,G ,G to be
1 2 T
infeasible.
DLP: Given x,xa, compute a.
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
Example: Boneh-Lynn-Shacham signatures
Setup:
Bilinearpairinge:G ×G →G .
1 2 T
PublicP,Q ∈G .
1
Secreta∈ZsuchthatQ =Pa.
HashfunctionH :{0,1}∗ →G .
2
Signature on message m is σ = H(m)a.
To verify signature: see if e(Q,H(m)) = e(P,σ).
Ifsignatureiscorrect,thenbothequale(P,H(m))a.
IfDLPisinfeasible,thensignaturecannotbeforged.
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
Useful pairings: Abelian varieties over finite fields
For certain abelian varieties A/F , subgroups of A(F ) of
q q
prime order r have the necessary properties.
Pairings are Weil pairing
e : A[r]×A[r] → µ ⊂ F×
weil,r r qk
or Tate pairing (more complicated).
k is the embedding degree of A with respect to r.
Smallestintegersuchthatµ ⊂F× (⇔qk ≡1modr).
r qk
If q,r are large, DLP is infeasible in A[r] and F×.
qk
Pairings can be computed efficiently via Miller’s algorithm.
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
Need to “balance” security on variety and in finite field
Best DLP algorithm in A[r] is exponential-time.
Best DLP algorithm in F× is subexponential-time.
qk
For comparable security before and after pairing, need
qk > r.
How much larger depends on desired security level:
Common security levels for elliptic curves
r qk Embedding degree k Secure until
(bits) (bits) (if r ≈ q) year
160 1024 6 2010
224 2048 10 2030
256 3072 12 2050
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
The Problem
Find primes q and abelian varieties A/F having
q
1 asubgroupoflargeprimeorderr,and
2 prescribed(small)embeddingdegreek withrespecttor.
Inpractice,wantr >2160andk ≤50.
We call such varieties “pairing-friendly.”
Want to be able to control the number of bits of r to
construct varieties at varying security levels.
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
“Random” abelian varieties not useful for
pairing-based cryptography
Embedding degree of random A/F with order-r subgroup
q
will be ≈ r.
Typical r ≈ 2160, so pairing on random A can’t even be
computed.
Conclusion: pairing-friendly abelian varieties are “special.”
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
Some types of pairing-friendly abelian varieties
Menezes-Okamoto-Vanstone, Galbraith, Rubin-Silverberg:
supersingular A/F are always pairing-friendly.
q
Ifdimensiong ≤6thenk ≤7.5g.
Thesek areonlyacceptableforthelowestsecuritylevels.
Highersecuritylevelsrequirenon-supersingular
(usually,ordinary)abelianvareities.
Pairing-friendlyordinaryellipticcurves(g=1)well-studied.
Manyconstructionswithsmallk andq <r2.
Canconstructellipticcurveswithk ∈{3,4,6,10,12}and
primeorder(q ≈r).
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
Higher dimensions: more difficult
Galbraith-McKee-Valença, Hitt: existence results for
non-supersingularpairing-friendlyabeliansurfaces(g = 2)
Noexplicitconstruction.
F. ‘07: explicit construction of ordinary abelian surfaces
with arbitrary embedding degree.
Kawazoe-Takahashi: construct ordinary abelian surfaces
over smaller fields, but not absolutely simple.
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography
AbelianVarietiesandPairing-BasedCryptography Pairing-BasedCryptography
ConstructingPairing-FriendlyAbelianVarieties:Method1 Pairing-friendlyAbelianVarieties
ConstructingPairing-FriendlyAbelianVarieties:Method2 OurResults
Algorithms for constructing pairing-friendly A.V.
Result #1 (ANTS-VIII, with P. Stevenhagen & M. Streng)
Methodforconstructingprimesq andordinaryA/F that
q
haveasubgroupoforderr andprescribedembedding
degreek.
Worksforabitraryk,nearlyarbitraryr.
Fieldsizesarelarge.
Bestcases: q≈r4fordimA=2,q≈r6fordimA=3.
Result #2 (Pairing ‘08)
Methodforconstructingprimesq andordinaryA/F that
q
haveasubgroupoforderr andprescribedembedding
degreek.
Worksformorerestrictedsetofk andr.
Fieldsizesarenotaslarge.
Bestcases: q≈r2fordimA=2,q≈r4fordimA=3.
DavidFreeman ConstructingAbelianVarietiesforPairing-BasedCryptography