We usually need pairing-friendly curves in order to use them for bilinear pairing computation. Is Curve25519 a pairing-friendly curve? If not, can we still use it for pairings and how much more inefficient would a pairing computation on this curve be compared to a BN curve?
Asked
Active
Viewed 807 times
1 Answers
5
The embedding degree specifies how many times bigger the finite-field you map to is compared to the field the curve is defined over.
For example for BN(2,254) the degree is 12, mapping to a 3000 bit field, which matches the security level of the curve (~128 bits of security for both) and is reasonably efficient (you can perform a couple of hundred exponentiations per second in this field).
For Curve25519 the degree is 1206167596222043702328864427173832373476186059896651267666991823047575708498 $\approx 10^{75}$, mapping to a $\approx 3 \cdot10^{75}$ bit field. It's rather unlikely that you could afford a computer which can store an element of this field or perform computations on it.
CodesInChaos
- 24,841
- 2
- 89
- 128
-
wouldn't change much but it should be $\approx 3 \cdot 10^{77}$ (not $75$), or? – J. Doe Mar 05 '21 at 12:22