Pairing-Friendly Elliptic Curves of Prime Order

By Paulo L. Barreto, Michael Naehrig. 2005

1,116 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

Citations in the corpus

Geppetto: Versatile Verifiable Computation (2015, methodology): “As a pragmatic alternative, we use a sequence of nested curves (an option suggested previously [9, Footnote 10]) to in-stantiate and implement bounded bootstrapping , Speciﬁcally, we instantiate one version of Geppetto with the same highly efﬁcient BN curve [6] employed by Pinocchio.”
Pinocchio: Nearly Practical Verifiable Computation (2013, methodology): “For the cryptographic code, we use a highspeed elliptic curve library [45] with a 256-bit BN-curve [46]”
Quadratic Span Programs and Succinct NIZKs without PCPs (2013, methodology): “We use a pairing-based encoding, with a 256-bit BN-curve [5] that provides 128 bits of security.”
Short Group Signatures (2004, methodology): “Using Barreto Naehrig curves [6], we can instead take p to be a 160-bit prime.”
The Eta Pairing Revisited (2006, methodology): “For and we recover the representation of as an elliptic curve of as presented by Barreto and Naehrig [4].”
Optimal Pairings (2010, background): “The family of BN-curves [4] has and is given by the following parametrization:”
Efficient and Provably-Secure Identity-Based Signatures and Signcryption from Bilinear Maps (2005, background): “Such bilinear map groups are known to be instantiable with ordinary elliptic curves such as those suggested in [29] or [4].”
Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture (2014, methodology): “To facilitate comparison with prior work, we instantiate our techniques for two specific algebraic setups: we provide an instantiation based on Edwards curves [33] at 80 bits of security (as in [16]), and an instantiation based on Barreto–Naehrig curves [9] at 128 bits of security (as in [56, 27]).”
Group signatures with verifier-local revocation (2004, methodology): “Using Barreto Naehrig curves [ 4 ], one can instead take p to be a 160-bit prime.”
Faster Explicit Formulas for Computing Pairings over Ordinary Curves (2011, methodology): “The Optimal Ate pairing [8] computed entirely on twists [9] with simplified final line evaluations [6] over a recently-introduced subclass [10] of the Barreto-Naehrig (BN) family of pairing-friendly elliptic curves [11].”
Signing a Linear Subspace: Signature Schemes for Network Coding (2009, background): “Such groups G1 can be obtained by using pairing-friendly elliptic curves of prime or near-prime order, such as supersingular curves or the families of ordinary curves given by Miyaji, Nakabayashi, and Takano [26], BarretoNaehrig [2], or Freeman [11].”
New Software Speed Records for Cryptographic Pairings (2010, methodology): “At the 128-bit security level, a nearly optimal choice for a pairing-friendly curve is a Barreto-Naehrig (BN) curve [10] over a prime field of size roughly 256 bits with embedding degree k = 12.”
Sequential Aggregate Signatures and Multisignatures Without Random Oracles (2006, methodology): “This setting allows us to take advantage of curves due to Barreto and Naehrig [3].”
A Taxonomy of Pairing-Friendly Elliptic Curves (2010, methodology): “Viewing the Barreto-Naehrig construction in this way allows us to extend the construction to the other quadratic u ( x ) for which Φ 12 ( u ( x )) factors.”
Short Signatures Without Random Oracles and the SDH Assumption in Bilinear Groups (2008, methodology): “When we instantiate the pairing using the elliptic curves described in [2,11], we obtain a signature whose length is approximately the same as a DSA signature with the same security, but which is proven secure without the random oracle model.”