The Realm of the Pairings Paulo S. L. M. Barreto Prolegomena - - PowerPoint PPT Presentation
The Realm of the Pairings Paulo S. L. M. Barreto Prolegomena Thanks to the organizers of SAC 2013 for the invitation! Accompanying paper: joint work with D. Aranha, P. Longa and J. Ricardini. I know Im speaking in a marvelous
Thanks to the organizers of SAC 2013 for
Accompanying paper: joint work with
“I know I’m speaking in a marvelous
Hard task ahead: very first talk, to a very
Tax payment authentication.
Government of São Paulo, Brazil. > 40 × 106 inhabitants, 1/3 of GDP.
Old system (before 2001):
Mechanical, non-cryptographic authentication system
(authenticating printer).
Manual verification, requiring a trusted user.
Frauds!
Government admitted to 5% [sic] of tax payment
evasion out of a $500 × 106 gross monthly tax revenue (for just one type of tax, namely, car licensing).
New system needed!
3
Automatic process, without manual intervention. Open specification, unencumbered by patents. Public-key scheme with security level roughly
equivalent to RSA-1024.
Authentication tag must be printable on two
alphanumerical lines (320 bits).
Half of the available space is occupied by context
information (user id, bank id, amount paid, date, etc).
About 2 − 4 × 106 authentications a month must
be handled on a single Pentium II 450 MHz PC.
Not for the faint of heart
4
160-bit signatures: ECDSA would
Available options at the time:
CFS Quartz OP/BLS (preprint)
Would any of these be acceptable?
5
CFS
Very slow to generate (no more than ~4 × 104
sigs/month on target platform).
Quartz
Unknown security (now broken). Covered by patents.
OP/BLS
No patents. Formal proof of security (under the gap Diffie-
Hellman assumption).
Reported efficiency at the time scaled to ~4 × 105
sigs/month on target platform.
6
The pairing-based OP/BLS scheme was
7
All reqs satisfied:
CPU >80% idle after improvement by
B., Kim, Lynn and Scott.
Room for business rule improvements.
Government reported that frauds
Still in use today – no further
8
Seminal use: cryptanalysis (MOV & FR attacks). Amazingly flexible tool for constructing cryptosystems with
novel and useful features (Antoine Joux is one of the key researchers to blame ).
Identity-based schemes:
Signatures (plain, blind, proxy, ring, undeniable, batch, …) Encryption (plain, broadcast, keyword-search capable, …) Signcryption Key agreement (plain, authenticated, group, …) Hierarchical cryptosystems Threshold cryptosystems (secret sharing, signatures, …) Chameleon hash and signatures ...
9
“Conventional” systems
Access control, identification and traitor tracing Credentials (anonymous, hidden, self-blindable, …) Key agreement and non-interactive key distribution Encryption (strongly insulated, intrusion-resilient, …) Signatures (short, group, aggregate, ring, verifiably encrypted,
blind, partially blind, proxy, undeniable, limited-verifier, …)
Signcryption Threshold cryptosystems (secret sharing, signatures) Hierarchical and role-based cryptosystems Chameleon hash and signatures Certificateless and self-certified PKC ...
10
“Pairings are too slow for practical
To what extent is this (in)correct? But first, some theory (caveat:
11
Let 1, 2, and 𝑈 be groups of the same order 𝑜,
the first two usually written additively and the third one written multiplicatively.
A bilinear map (or pairing) is a function
𝑓 ∶ 1 × 2 → 𝑈 satisfying the conditions:
Bilinearity: ∀𝑄 ∈ 1, 𝑅 ∈ 2, 𝑏 ∈ ℤ/𝑜ℤ ∶ 𝑓 𝑏𝑄, 𝑅 = 𝑓 𝑄, 𝑏𝑅 =
𝑓 𝑄, 𝑅 𝑏.
Non-degeneracy: ∀𝑄 ∈ 1, ∃𝑅 ∈ 2 ∶ 𝑓 𝑄, 𝑅 ≠ 1. Efficiently computable.
12
Setup: 𝑓 ∶ 1 × 2 → 𝑈, 𝐼 ∶ 0,1 ∗ → 1. Key pair: (𝑡
$ ℤ/𝑜ℤ, 𝑊 ← 𝑡𝑅 ∈ 2).
Signature: Σ ← 𝑡𝐼 𝑛 ∈ 1. Verification: accept 𝑛, Σ ⇔
Explanation: 𝑓 Σ, 𝑅 = 𝑓 𝑡𝐼 𝑛 , 𝑅 =
13
Pairings of interest are certain rational
functions on elliptic curves.
An elliptic curve is a smooth projective
algebraic curve of genus 1 with at least one marked point (∞).
Projective equation: points [𝑌 ∶ 𝑍 ∶ 𝑎] with
𝑍2𝑎 + 𝑏1𝑌𝑍𝑎 + 𝑏3𝑍𝑎2 = 𝑌3 + 𝑏2𝑌2𝑎 + 𝑏4𝑌𝑎2 + 𝑏6𝑎3 (*)
Affine part equation: points (𝑦, 𝑧) with
𝑧2 + 𝑏1𝑦𝑧 + 𝑏3𝑧 = 𝑦3 + 𝑏2𝑦2 + 𝑏4𝑦 + 𝑏6, together with an extra point at infinity, which corresponds to 𝑎 = 0 in the projective form.
Group law defined for the points of a curve
(chord-and-tangent method).
14 (*) actually other kinds of projective coordinates are usually adopted
𝑄 ∶ 𝑎𝑄]
𝑅 ∶ 𝑎𝑅]
𝑆 ∶ 𝑎𝑆]
𝑅𝑎𝑄 − 𝑍 𝑄𝑎𝑅
𝑆 ← −𝜇3𝑎𝑄𝑎𝑅 + 𝜇𝜈2𝑌𝑅𝑎𝑄 − 𝜈3𝑍 𝑄𝑎𝑅
Look more complicated, but involve no inversion, and have lots of common factors
𝑦𝑅 − 𝑦𝑄
−1
Input: 𝑄 ∈ 𝐹; 𝑠 = 𝑠 𝑢, 𝑠 𝑢−1, … , 𝑠 0 2 ∶ 𝑠 𝑢 = 1 Output: 𝑠𝑄 1.
𝐵 ← 𝑄
2.
for 𝑘 ← 𝑢 − 1 downto 0 do
3.
𝐵 ← 2𝐵
4.
if 𝑠
𝑘 = 1 then 5.
𝐵 ← 𝐵 + 𝑄
6.
end if
7.
end for
8.
return 𝐵
16
for obvious reasons
A rational map 𝑔 over 𝕃 is a function of
Both (𝑨) and ℎ(𝑨) split over 𝕃
𝑛𝑘 𝑡 𝑘=1
𝑢 𝑙=1
17
Assume that gcd
𝑘
𝑙
All one needs to know to define 𝑔 up to
18
The divisor of a rational map 𝑔 is a tabular
The degree of a divisor is the sum of all
Properties: (𝑑) = 0, (𝑔) = (𝑔) + (),
Hey apple!
19
Divisors of functions defined on the points
General divisors are unrestricted tabular
𝑄
Not all possible divisors correspond to
20
Divisors constitute an Abelian group under
𝑄
𝑄
𝑄
A divisor may be huge – there are infinite
21
Two divisors 𝔈1 and 𝔈2 are equivalent iff their
difference is the divisor of a function, i.e. 𝔈1 ~ 𝔈2 𝔈1 – 𝔈2 = (𝑔) for some 𝑔.
The Cantor-Koblitz algorithm reduces any divisor to a
uniquely defined equivalent divisor of the form 𝑛𝑄(𝑄)
𝑄
− 𝑛𝑄
𝑄
(∞) where 𝑛𝑄
𝑄
≤ where is the curve genus.
Reduced divisors over elliptic curves are of the form
𝑄 − (∞) for some 𝑄.
22
A Miller function is any function 𝑔 𝑗,𝑄 such that
𝑔
𝑗,𝑄 = 𝑗 𝑄 − 𝑗𝑄 − (𝑗 − 1)(∞).
Notice that 𝑔
𝑜,𝑄 = 𝑜 𝑄 − 𝑜(∞).
Also, 𝑔
0,𝑄 = 𝑔 1,𝑄 = 0, i.e. 𝑔 0,𝑄 and 𝑔 1,𝑄 are constant.
The line ℓ𝑉,𝑊 through points 𝑉 and 𝑊 has divisor
ℓ𝑉,𝑊 = 𝑉 + 𝑊 + −𝑉 − 𝑊 − 3(∞).
The vertical line 𝑤𝑄 through a point 𝑄 has divisor
𝑤𝑄 = 𝑄 + −𝑄 − 2(∞).
Miller functions satisfy a recursive relation
𝑔
𝑗+𝑘,𝑄 = 𝑑 𝑔 𝑗,𝑄 𝑔 𝑘,𝑄 ℓ𝑗𝑄,𝑘𝑄 𝑤 𝑗+𝑘 𝑄.
23
𝑔
𝑗+𝑘,𝑄 = 𝑗 + 𝑘
𝑄 − 𝑗 + 𝑘 𝑄 − 𝑗 + 𝑘 − 1 ∞ = 𝑗 𝑄 − 𝑗𝑄 − 𝑗 − 1 ∞ + 𝑘 𝑄 − 𝑘𝑄 − 𝑘 − 1 ∞ + 𝑗𝑄 + 𝑘𝑄 + − 𝑗 + 𝑘 𝑄 − 3 ∞ − 𝑗 + 𝑘 𝑄 − − 𝑗 + 𝑘 𝑄 + 1 + 1 ∞ = 𝑔
𝑗,𝑄 + 𝑔 𝑘,𝑄 + ℓ𝑗𝑄,𝑘𝑄 − 𝑤 𝑗+𝑘 𝑄
= 𝑔
𝑗,𝑄 𝑔 𝑘,𝑄 ℓ𝑗𝑄,𝑘𝑄 𝑤 𝑗+𝑘 𝑄 . ∴ 𝑔 𝑗+𝑘,𝑄 = 𝑑 𝑔 𝑗,𝑄 𝑔 𝑘,𝑄 ℓ𝑗𝑄,𝑘𝑄 𝑤 𝑗+𝑘 𝑄 for some 𝑑.
24
Miller’s algorithm computes 𝑔 𝑜,𝑄(𝑅) up to 𝑑
concomitantly with the double-and-add scalar multiplication 𝑜𝑄.
The trick:
𝑔
𝑗+1,𝑄 = 𝑔 𝑗,𝑄 𝑔 1,𝑄 ℓ𝑗𝑄,𝑄/𝑤 𝑗+1 𝑄 (= 𝑔 𝑗,𝑄 ℓ𝑗𝑄,𝑄/𝑤 𝑗+1 𝑄).
𝑔
2𝑗,𝑄 = 𝑔 𝑗,𝑄 2 ℓ𝑗𝑄,𝑗𝑄/𝑤 2𝑗 𝑄.
Functions ℓ𝑗𝑄,𝑄, ℓ𝑗𝑄,𝑗𝑄, 𝑤 𝑗+1 𝑄, and 𝑤 2𝑗 𝑄 appear
naturally during the computation of 𝑜𝑄.
Denominators might be evaluated on a point where they
vanish: use 𝑜 𝑄 + 𝑆 − 𝑜 𝑆 ~ 𝑜 𝑄 − 𝑜(∞) for random 𝑆.
25
Input: 𝑄 ∈ 1, 𝑅 ∈ 2, 𝑜 = 𝑜𝑢, 𝑜𝑢−1, … , 𝑜0 2 ∶ 𝑜𝑢 = 1 Output: 𝑔 𝑜,𝑄(𝑅) up to a constant 1.
𝑔 ← 1, 𝑆
$
← 𝐹, 𝐵 ← 𝑄
2.
for 𝑘 ← 𝑢 − 1 downto 0 do
3.
𝑔 ← 𝑔2 ℓ𝐵,𝐵 𝑅 + 𝑆 𝑤2𝐵 𝑆 / ℓ𝐵,𝐵 𝑆 𝑤2𝐵 𝑅 + 𝑆 , 𝐵 ← 2𝐵
4.
if 𝑜𝑘 = 1 then
5.
𝑔 ← 𝑔 ℓ𝐵,𝑄 𝑅 + 𝑆 𝑤𝐵+𝑄 𝑆 / ℓ𝐵,𝑄 𝑆 𝑤𝐵+𝑄 𝑅 + 𝑆 , 𝐵 ← 𝐵 + 𝑄
6.
end if
7.
end for
8.
return 𝑔
26
The Weil pairing of order 𝑜 at points 𝑄 and 𝑅 is
𝑥(𝑄, 𝑅) ∶= 𝑔
𝑜,𝑄(𝑅)/𝑔 𝑜,𝑅(𝑄). Note that the constant
factor 𝑑 of 𝑔 is irrelevant – it does not affect the pairing value.
Miller’s algorithm computes 𝑔 𝑜,𝑄(𝑅) (and of course
𝑔
𝑜,𝑅(𝑄) as well), and hence the Weil pairing.
Exercise: show that this function is indeed a
bilinear map.
27
The Tate pairing at points P and Q is defined as
𝜐(𝑄, 𝑅) ∶= 𝑔
𝑜,𝑄 𝑅 𝑨 where 𝑨 ∶= (𝑟𝑙 − 1)/𝑜. The (𝑟𝑙 − 1)/𝑜 exponent contains all factors 𝑟𝑗 − 1
where 𝑗 | 𝑙. This eliminates 𝑑 by Fermat’s Little Theorem.
One invocation of Miller’s algorithm is traded for
28
NSA’s Jerry Solinas claimed (verbally) to
~15 minutes on a PC (around 1990, so
Boneh et al. reported ~2.9 s on a 1GHz
Long way to go...
Anecdote: more than one researcher claim
All rejected! “What’s the point? You only get a few bits
Tate-like pairings: any factor or denominator in a
subfield vanishes due to the final exponentiation.
Swap the arguments: computing 𝑔 𝑜,𝑅(𝑄) instead
𝑜,𝑅 𝑄 may lead to shorter loop length.
Optimal pairings: shortest possible loop length
ℓ~𝜚(𝑙) for embedding degree 𝑙.
Final exponentiation may become the bottleneck! [R.I.P.] 𝜃𝑈 pairing: was the fastest known pairing,
but is now defunct (Antoine Joux has more to say about this ).
31
Weil pairing: 𝑥(𝑄, 𝑅) ∶= 𝑔
𝑜,𝑄(𝑅)/𝑔 𝑜,𝑅(𝑄).
Tate pairing: 𝜐(𝑄, 𝑅) ∶= 𝑔
𝑜,𝑄 𝑅 𝑨 where 𝑨 ∶= (𝑟𝑙 − 1)/𝑜.
Eta pairing (or twisted Ate pairing when defined over an ordinary curve): 𝜃 𝑄, 𝑅 ∶= 𝑔
𝜇,𝑄 𝑅 𝑨 where 𝜇𝑒 ≡ 1 (mod 𝑜).
Ate pairing: 𝑏(𝑄, 𝑅) ∶= 𝑔
𝑢−1,𝑅 𝑄 𝑨, where 𝑢 is the trace of the
Frobenius endomorphism.
Optimized Ate and twisted Ate pairings: 𝑏𝑑(𝑄, 𝑅) ∶= 𝑔 𝑢−1 𝑑 mod 𝑜,𝑅 𝑄 𝑨, 𝜃𝑑 𝑄, 𝑅 ∶= 𝑔𝜇𝑑 mod 𝑜,𝑄 𝑅 𝑨, for some 0 < 𝑑 < 𝑙.
Optimal Ate pairing: 𝑏opt(𝑄, 𝑅) ∶= 𝑔
ℓ,𝑅 𝑄 𝑨 for a certain ℓ such that
lg ℓ ≈ (lg 𝑜)/𝜒(𝑙).
Eil pairing: 𝑥𝑡 𝑄, 𝑅 ≔ −𝜕𝑔
𝑡,𝑄(𝑅)/𝑔 𝑡,𝑅(𝑄) where 𝑡 ≔ 𝑟 mod 𝑜 and
𝜕𝑙 ≡ 1.
...
32
Not all elliptic curves are suitable for pairing
applications.
On the one hand, the embedding degree 𝑙 must
be small enough to make 𝔾𝑟𝑙 arithmetic tractable (but it is usually enormous).
On the other hand, 𝑙 must not be proportionally
too small: the value of 𝑙 lg 𝑟 must ensure that the discrete logarithm problem in 𝔾𝑟𝑙
∗ , where
subexponential algorithms exist, remains intractable.
33
Supersingular curves allow for the limited
Several methods to construct curves
34
Algebraic constructions allow for a better relation
between 𝑜 and 𝑟 for certain values of 𝑙:
BN curves attain 𝜍 = 1 for 𝑙 = 12; ideal around security
level around 2128.
KSS and BLS12 curves provide the best tradeoff for
security level 2192.
BLS24 curves are the most suitable family known when
addressing the 2256 security level.
Holistic trend: choose pairing-friendly curves that
improve all operations needed by cryptosystems (nor just pairing computation).
35
𝐹/𝔾𝑞 ∶ 𝑧2 = 𝑦3 + 𝑐 (a Bachet curve) #𝐹 = 𝑜 = 𝑞 + 1 − 𝑢 where, for some 𝑣 ∈ ℤ:
𝑞 = 𝑞 𝑣 = 36𝑣4 + 36𝑣3 + 24𝑣2 + 6𝑣 + 1 𝑜 = 𝑜 𝑣 = 36𝑣4 + 36𝑣3 + 18𝑣2 + 6𝑣 + 1 𝑢 = 𝑢 𝑣 = 6𝑣2 + 1
Abundant and easy to find. Embedding degree 12 (ideal at security level 2128
but good between legacy 280 and long-term 2192).
Very friendly holistic subfamilies.
36
37
ℓ2𝑗
lg ℓ 𝑗=0
2(𝑅)
Complicated but efficient! Still doing elliptic arithmetic...
Projective coordinates avoid field
Affine coordinates need inversions,
… or are they?
38
39
Who Mcyc Processor Coord Hankerson, Scott, Menezes 10.0 Core 2 projective Naehrig, Niederhagen, Schwabe 4.40 Core 2 projective Beuchat et al. 2010 2.95 Core 2 projective Beuchat et al. 2010 2.90 Nehalem projective Aranha et al. 2011 2.20 Core 2 projective Aranha et al. 2011 2.00 Nehalem projective Aranha et al. 2011 1.56 Phenom II projective Zavattoni et al. 2013 1.51 Sandy Bridge projective Mitsunari 2013 1.33 Haswell projective Mitsunari 2013 1.17 Haswell+mulx projective [new] 1.42 Sandy Bridge projective [new] 1.21 Haswell projective [new] 1.18 Haswell+mulx projective Acar, Lauter,Naehrig, Shumow 15.6 Core 2 affine [new] 2.43 Nehalem affine
“Pairings are too slow for practical
Sandy Bridge, Wei Dai’s Crypto++ 5.6.2
40
Operation Timings (Mcyc) RSA 3072 signing 25.56 Affine pairing 1.94 Projective pairing 1.43 RSA 3072 verification 0.29
𝒇(𝑸, 𝑹)
“Wait! How about storage, how about
embedded processors?”
On a MICAz, the RELIC library computes a
pairing at the 280 security level in ~8s.
State-of-the-art RSA 1024 takes ~10s. … both quickly taking all available 4 KiB
RAM, hence long way to go...
At ECC 2004 I pointed out a number of
Many of those have been solved (e.g. BN
It seems only fit to make some new ones
What is the speed limit for pairings?
Clearly, this depends on the platform. Perhaps the real question is: what platforms
are closest to ideal?
Higher security
Better parameters than BLS curves?
Very constrained platforms (e.g. SIM
Internet of Things, including embedded
processors and WSNs.
43
Implement projective (and affine) pairings
Find a family of pairing-friendly curves of
Implement pairings convincingly on a very
44