Paper 2019/555

Optimal TNFS-secure pairings on elliptic curves with composite embedding degree

Georgios Fotiadis and Chloe Martindale


In this paper we present a comprehensive comparison between pairing-friendly elliptic curves, considering different curve forms and twists where possible. We define a measure of the efficiency of a parametrized pairing-friendly family that takes into account the number field sieve (NFS) attacks (unlike the $\rho$-value). This measure includes an approximation of the security of the discrete logarithm problem in $\mathbb F_{p^k}^*$, computed via the method of Barbulescu and Duquesne [4]. We compute the security of the families presented by Fotiadis and Konstantinou in [13], compute some new families, and compare the efficiency of both of these with the (adjusted) BLS, KSS, and BN families, and with the new families of [19]. Finally, we present an optimal pairing-friendly elliptic curve for security level 128 and recommend two pairing-friendly elliptic curves for security level 192.

Available format(s)
Public-key cryptography
Publication info
Preprint. MINOR revision.
Optimal ate pairingtwists of elliptic curvesjacobian coordinatesTNFS-secureSexTNFS
Contact author(s)
georgios fotiadis @ uni lu
chloemartindale @ gmail com
2019-08-22: revised
2019-05-25: received
See all versions
Short URL
Creative Commons Attribution


      author = {Georgios Fotiadis and Chloe Martindale},
      title = {Optimal TNFS-secure pairings on elliptic curves with composite embedding degree},
      howpublished = {Cryptology ePrint Archive, Paper 2019/555},
      year = {2019},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.