a comparison of mnt curves and supersingular curves.pdfVIP

A comparison of MNT curves and supersingular curves D. Page, N.P. Smart and F. Vercauteren Dept. Computer Science, University of Bristol, Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB, United Kingdom. {page,nigel,frederik}@cs.bris.ac.uk Abstract. We compare both the security and performance issues re- lated to the choice of MNT curves against supersingular curves in char- acteristic three, for pairing based systems. We pay particular atten- tion to equating the relevant security levels and comparing not only computational performance and bandwidth performance. The paper fo- cuses on the BLS signature scheme and the Boneh–Franklin encryption scheme, but a similar analysis can be applied to many other pairing based schemes. 1 Introduction The initial pairing based cryptographic protocols, see [15], [22] and [23], were couched in the language of a generic pairing function. However, in latter work such as the (BLS) short signature scheme of Boneh, Lynn and Shacham [8] or the identity based encryption scheme of Boneh and Franklin [7] the protocols are given in terms of a symmetric pairing, as is found on supersingular curves. For all protocols there are essentially two possible choices for selecting the underlying groups on which to work: – To use supersingular curves, of which the most efficient ones appear to be in characteristic three. – To use, so-called, MNT curves in large prime characteristic [19]. These are ordinary, as opposed to supersingular curves. T