Subject: Re: [Cfrg] Fwd: I-D Action: draft-kasamatsu-bncurves-00.txt

From: Laura Hitt <[email-masked]>
Date: Thu, 23 Jan 2014 14:50:43 -0600

Hi Kohei,

Regarding your statement in Section 6, "The elliptic curve that supports a
bilinear map requires the hardness of solving following problems, since the
security of pairing-based cryptographic primitives is based on hardness of
these problems."  You then list the ECDLP, ECDHP, BDHP, and ECDLP with
auxiliary inputs.

I would be hesitant to suggest all pairing-based cryptographic primitives
are based on the hardness of only those problems...it's conceivable that a
pairing-based scheme could be based on another hard problem, such as
solving the isogeny problem or co-gap DH. (See, for example, Section 6 of
"Evaluating Large Degree Isogenies and Applications to Pairing Based
Cryptography" by Broker, Charles, Lauter, or "Improved algorithm for the
isogeny problem for ordinary elliptic curves" by Galbraith & Stolbunov.)

Best,
Laura

-----Original Message-----
From: Cfrg [mailto:[email-masked]] On Behalf Of Kohei Kasamatsu
Sent: Wednesday, January 22, 2014 6:04 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: [Cfrg] Fwd: I-D Action: draft-kasamatsu-bncurves-00.txt

Hi cfrg folks,

Elliptic curves with a special map called a pairing allow cryptographic
primitives to achieve functions or efficiency which cannot be realized by
conventional mathematical tools. For example, ZSS signature is one of these
primitives.

We have recently submitted an I-D on Barreto-Naehrig curves (BN-curves)
which provide efficient operations of a pairing.
The I-D specifies parameters of BN-curves which are particularly useful for
realization of efficient cryptographic schemes based on pairing and
parameters of BN-curves which are compliant with ISO/IEC 15946-5.

We will propose I-Ds on computation of pairing and pairing-based primitives
in order to contribute to IETF community in the near future.

We would appreciate your comments and suggestions on our I-D and works.

Best,
Kohei KASAMATSU
-------- Original Message --------
Subject: I-D Action: draft-kasamatsu-bncurves-00.txt
Date: Thu, 09 Jan 2014 21:13:03 -0800
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

         Title           : Barreto-Naehrig Curves
         Authors         : Kohei Kasamatsu
                           Satoru Kanno
                           Tetsutaro Kobayashi
                           Yuto Kawahara
        Filename        : draft-kasamatsu-bncurves-00.txt
        Pages           : 15
        Date            : 2014-01-09

Abstract:
    Elliptic curves with pairing are useful tools for constructing
    cryptographic primitives.  In this memo, we specify domain parameters
    of Barreto-Naehrig curve (BN-curve) [5].  The BN-curve is an elliptic
    curve suitable for pairings and allows us to achieve high security
    and efficiency of cryptographic schemes.  This memo specifies domain
    parameters of two 254-bit BN-curves [1] [2] which allow us to obtain
    efficient implementations and domain parameters of 224, 256, 384, and
    512-bit BN-curves which are compliant with ISO/IEC 15946-5[3].
    Furthermore, this memo organizes differences between types of
    elliptic curves specified in ISO document and often used in open
    source softwares, which are called M-type and D-type
    respectively[21].

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-kasamatsu-bncurves/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-kasamatsu-bncurves-00

Please note that it may take a couple of minutes from the time of
submission until the htmlized version and diff are available at
tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft<https://www.ietf.org/mailman/listinfo/i-d-announceInternet-Draft>directories:
http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

_______________________________________________
Cfrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/cfrg

---

From: Laura Hitt <[email-masked]>
Date: Wed, 29 Jan 2014 12:35:36 -0600

Hi Kohei,
Yes, thank you, that modification is better.
-Laura

-----Original Message-----
> From: Kohei Kasamatsu [mailto:[email-masked]]
> Sent: Wednesday, January 29, 2014 5:02 AM
> To: Laura Hitt; [email-masked]
> Subject: Re: [Cfrg] Fwd: I-D Action: draft-kasamatsu-bncurves-00.txt
>
> Hi Laura,
>
>
> Thank you for your comments.
>
> > Regarding your statement in Section 6, "The elliptic curve that
> > supports a bilinear map requires the hardness of solving following
> > problems, since the security of pairing-based cryptographic primitives
> > is based on hardness of these problems."  You then list the ECDLP,
> > ECDHP, BDHP, ECDLP with auxiliary inputs.
> >
> > I would be hesitant to say ALL pairing-based cryptographic primitives
> > are based on the hardness of those problems...perhaps it's true, but
> > it's conceivable that a pairing-based scheme could be based on another
> > hard problem, such as solving the isogeny problem or co-gap DH. (See,
> > for example, Section 6 of "Evaluating Large Degree Isogenies and
> > Applications to Pairing Based Cryptography" by Broker, Charles,
> > Lauter, or "Improved algorithm for the isogeny problem for ordinary
> > elliptic curves" by Galbraith & Stolbunov.)
>
> We agree with it.
> As you say, there are pairing-based cryptographic primitives based on the
> hardness of different problems from these described in our draft.
>
> We would like to change
> "The elliptic curve that supports a bilinear map requires the hardness of
> solving following problems, since the security of pairing-based
> cryptographic primitives is based on hardness of these problems."
> to
> "Pairing-based cryptographic primitives are often based on the hardness of
> the following problems, so when the elliptic curves from this document are
> used in such schemes, these problems would apply."
>
> Does the modification despel the concern?
>
> Best,
> Kohei KASAMATSU
>
>
> (2014/01/24 3:13), Laura Hitt wrote:
> > Hi Kohei,
> >
> > Regarding your statement in Section 6, "The elliptic curve that supports
> a bilinear map requires the hardness of solving following problems, since
> the security of pairing-based cryptographic primitives is based on hardness
> of these problems."  You then list the ECDLP, ECDHP, BDHP, ECDLP with
> auxiliary inputs.
> >
> > I would be hesitant to say ALL pairing-based cryptographic primitives
> > are based on the hardness of those problems...perhaps it's true, but
> > it's conceivable that a pairing-based scheme could be based on another
> > hard problem, such as solving the isogeny problem or co-gap DH. (See,
> > for example, Section 6 of "Evaluating Large Degree Isogenies and
> > Applications to Pairing Based Cryptography" by Broker, Charles,
> > Lauter, or "Improved algorithm for the isogeny problem for ordinary
> > elliptic curves" by Galbraith & Stolbunov.)
> >
> > Best,
> > Laura
> >
> > The I-D specifies parameters of BN-curves which are particularly useful
> for realization of efficient cryptographic schemes based on pairing and
> > We will propose I-Ds on computation of pairing and pairing-based
> primitives in order to contribute to IETF community in the near future.
> >
> > Internet-Draft directories: http://www.ietf.org/shadow.html or
> > ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> >
> >
> >
> >
> --
> NTT Software Corporation
> TEL: +81 45 212 7908 FAX: +81 45 212 9800
> E-mail: [email-masked]
>
>