Paper 2015/1212

Choosing and generating parameters for low level pairing implementation on BN curves

Sylvain Duquesne, Nadia El Mrabet, Safia Haloui, and Franck Rondepierre


Many hardware and software pairing implementations can be found in the literature and some pairing friendly parameters are given. However, depending on the situation, it could be useful to generate other nice parameters (e.g. resistance to subgroup attacks, larger security levels, database of pairing friendly curves). The main purpose of this paper is to describe explicitly and exhaustively what should be done to generate the best possible parameters and to make the best choices depending on the implementation context (in terms of pairing algorithm, ways to build the tower field, $\mathbb{F}_{p^{12}}$ arithmetic, groups involved and their generators, system of coordinates). We focus on low level implementations, assuming that $\mathbb{F}_p$ additions have a significant cost compared to other $\mathbb{F}_p$ operations. However, the results obtained are still valid in the case where $\mathbb{F}_p$ additions can be neglected. We also explain why the best choice for the polynomials defining the tower field $\mathbb{F}_{p^{12}}$ is only depending on the value of the BN parameter $u$ modulo small integers like $12$ as a nice application of old elementary arithmetic results. Moreover, we use this opportunity to give some new improvements on $\mathbb{F}_{p^{12}}$ arithmetic (in a pairing context) in terms of $\mathbb{F}_p$-addition allowing to save around $10\%$ of them depending on the context.

Note: abstract in the paper was completly wrong (it was not the last version)

Available format(s)
Publication info
Preprint. MINOR revision.
Contact author(s)
sylvain duquesne @ univ-rennes1 fr
2015-12-21: revised
2015-12-20: received
See all versions
Short URL
Creative Commons Attribution


      author = {Sylvain Duquesne and Nadia El Mrabet and Safia Haloui and Franck Rondepierre},
      title = {Choosing and generating parameters for low level pairing implementation on {BN} curves},
      howpublished = {Cryptology ePrint Archive, Paper 2015/1212},
      year = {2015},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.