Here we consider a method for quickly testing for group membership in the groups $\G_1$, $\G_2$ and $\G_T$ (all of prime order $r$) as they arise on a type-3 pairing-friendly curve.  As is well known endomorphisms exist for each of these groups which allows for faster point multiplication for elements of order $r$. The endomorphism applies if an element is of
order $r$. Here we show that, under relatively mild conditions, the endomorphism applies {\bf if and only if} an element is of order $r$. This results in a faster method of confirming group membership. In particular we show that the conditions are met for the popular BLS family of curves

Michael Scott

Cryptology ePrint Archive

A note on group membership tests for G1, G2and GT on BLS pairing-friendly curvesMichael ScottCryptography Research CentreTechnical Innovation Institutemichael.scott@tii.aeAbstract. Here we consider a method for quickly testing for groupmembership in the groups G1, G2 and GT (all of prime order r) as theyarise on a type-3 pairing-friendly curve. As is well known endomorphismsexist for each of these groups which allows for faster point multiplicationfor elements of order r. The endomorphism applies if an element is oforder r. Here we show that, under relatively mild conditions, the endo-morphism applies if and only if an element is of order r. This results ina faster method of confirming group membership. In particular we showthat the conditions are met for the popular BLS family of curves.1 IntroductionIn the course of running a cryptographic protocol you receive an element in acyclic group, whose prime order is a fixed system parameter. However crypto-graphic protocols are typically run in an untrusting environment. How can yoube sure that the element you have been given is actually of the correct order?You should worry because it might benefit an attacker to provide an element of adifferent order, typically in a much smaller sub-group. Your protocol depends forits security on executing in a large group, but now you find yourself unwittinglyconfined to a much smaller group, in which your “hard problem” is no longerhard. If you should continue to process such elements all bets are off concerningthe security of your protocol.In pairing-based protocols things are complicated by the fact that typicallythree groups are involved (on popular so-called type-3 pairing friendly curves[8]), usually referred to as G1, G2 and GT . If P ∈ G1 and Q ∈ G2, then apairing evaluates as e(P,Q) ∈ GT . While the groups G1 and G2 consist of pointson elliptic curves, the group GT is embedded in a finite extension field. Formore information on pairings and their role in cryptography, see [15]. All ofthe groups have the same prime order r, where r is typically at least 256-bitslong, to provide a secure setting for cryptography. In each setting the numberof plausible elements that could be presented will be hr for some co-factor h,different for each of the three groups. Typically in the pairing context h1 < r,and h2 > r and hT ≫ r. In deciding on an optimal strategy for confirming thatprotocol inputs are of the correct order r we will need to take into account thesize of this cofactor. For more cogent arguments on the importance of dealingwith co-factors, see section 1.1 of [11] “Pitfalls of a cofactor”.In fact that is not the only solution. We could choose our system parame-ters such that no small subgroups exist [14], [16], [2]. Now an attacker can onlyprovide elements of a larger prime order. Being confined to a larger group is un-likely to cause a problem, so the attack fails. The hope is that group membershiptesting now becomes largely redundant, which absolves a careless implementorfrom having to worry about the group membership issue. However this is not anentirely satisfactory solution. The provided element is not of the correct orderand the impact of, for example, inputting a supposed G2 point of the wrongorder into a pairing may not yet be fully understood. Another downside of thisapproach is that it is unlikely to be an option for G1 where usually h < r, suchthat no larger subgroups can exist.Going back to our original approach, two solutions currently exist. Assumethat the number of points on the curve G1 is hr. The first idea is to multiply anyincoming element by h to force it into the correct group. This is often referredto as “clearing the cofactor”. If it were of the correct order, this simply movesthe point to another point of order r. But this is not the original point, and thatmight introduce a complication for implementors. The second idea is to bite thebullet, and multiply the point by the full order r to confirm that this results inthe group neutral element, in this case O the point-at-infinity. However this isgoing to be costly.For elements in GT only the second solution appears competitive, given thelarge size of hT , even though exponentiation by hT (a process often referred toas the “hard part of the final exponentiation” in pairing literature) has beenhighly optimized [12].For G2 clearing the cofactor might still be an option using the fast methodfor cofactor elimination on BLS curves as described by Budroni and Pintore [7].In their paper [2], talking about the group G1, Barreto et al contend that“Therefore, one must carry out either a scalar multiplication by r to check forthe correct order or by the cofactor h to force points to have the right order.”Here we point to a third way, which provides the same assurance as multi-plying the point by the group order, but at a fraction of the cost.2 BLS-12 curvesThe BLS-12 elliptic curve [3] consists of points with coordinates x, y ∈ Fp thatsatisfyy2 = x3 +BIt is defined by a field modulusp = (u− 1)2/3.(u4 − u2 + 1) + uwhere u = 1 mod 3. The number of points on the curve is hr = p+1− t andthe pairing-friendly group of embedding degree 12 is of order r, where2r = u4 − u2 + 1t = u+ 1h = (u− 1)2/3where h is the curve cofactor. However as pointed out by Wahby and Boneh[19] the effective point cofactor ish1 = (u− 1)Each particular curve depends on the choice of u, which must be chosen suchthat p and r are prime. Curves are still plentiful under this constraint, so itis standard practise to pick a sparse u of low Hamming weight, as this bringsadvantages when calculating a pairing.The group G1 consists of points of order r on an elliptic curve over the basefield, that is on the curve E(Fp). The group G2 consists of points of order r ona sextic twist of the same curve E′(Fp2), defined over the quadratic extensionfield Fp2 . The number of points on this curve is h2r, where h2 is a much largerco-factor [13].h2 = (p2 + p+ 1− (t2 −√3(4pt2 − p4))/2)/rFinally GT consists of elements of order r in the extension field Fp12 . Thetotal number of elements in this extension field isp12 − 1 = (p6 − 1)(p2 + 1)((p4 − p2 + 1)/r)rFortunately there is a quick “cyclotomic test” based on the p-power Frobeniusto confirm that an element w is of an order that divides the cyclotomic factorp4 − p2 + 1 = hT .r [2].wp4−p2+1 = 1This can be confirmed by checking that w.wp4= wp2. So the cofactor ofconcern here ishT = (p4 − p2 + 1)/r3 The EndomorphismsAn elliptic curve is said to support an endomorphism if there is a quick method todetermine a non-trivial known multiple of any point, without having to performa point multiplication. The exploitation of an endomorphism to speed up generalpoint multiplication on an elliptic curve was first suggested by Gallant, Lambertand Vanstone [10], and is known as the GLV method. As applied to the groupG1 here, it takes the form3ψ(P ) = λPwhere ψ transforms the point from (x, y) to (β.x, y), where β is a precomputedcube root of unity modulo p, and λ is a nontrivial cube root of unity modulo theorder of the point, r. That is λ satisfies λ2+λ+1 = 0 mod r. Noting the similaritybetween this expression and the r parameter as it occurs for a BLS-12 curve, weget the neat solution λ = −u2. So for the BLS-12 curve the endomorphism is[9], [5]ψ(P ) = −u2PObserve that any multiplication by −u2 will be twice as quick as multiplica-tion by r.In the groups G2 and GT Galbraith and Scott [9] extend the idea of [10] bypointing out that a p-power Frobenius endomorphism applies in these groups.The p-power Frobenius map as applied to an extension field that is home to agroup like GT , arises as a consequence of a fast method to exponentiate to thepower of p. See [9], [5] for details. On our BLS-12 curve we can see that this willbe immediately useful, as for an element w of order r, given that r|(p + 1 − t),wp+1−t = 0 implies wp = wt−1 = wu. This time observe that exponentiation byu will be four times faster than exponentiation by r.The p-power Frobenius map is also the basis for an endomorphism that ap-plies in elliptic curve groups over extension fields like G2 [9]. In this case we geta fast way to calculate pQ, and for the BLS-12 curve we have pQ = uQ. Again,multiplication by u will be four times faster than multiplication by r.These endomorphisms are normally used to speed up the group operation, beit point multiplication in elliptic curve groups, or exponentiation in finite exten-sion field groups. Here we will be using them for an entirely different purpose,for confirming that group elements are indeed of the correct order r. Recall thatif the total number of possible elements is hr for some cofactor h, only those oforder r are members of the group. Let c be any non-trivial divisor of h. Then theother possibilities for an element are that it could be of an order c, or it couldbe of an order c.r. If these other possibilities can be excluded, we are assuredthat the element is of order r, and hence is a group member.4 The G2 caseConsider a point Q which purports to be a member of G2. The cofactor in thiscase is h2. Because the endomorphism should apply to Q, we can check thatpQ = uQ, which as we shall see costs little more than a point multiplication bya short, sparse u. This confirms that (p− u)Q = (p+ 1− t)Q = O. Therefore Qhas an order dividing p+ 1− t = hr.However we also know that Q is a point on E′(Fp2) and therefore has an orderdividing h2r. Therefore Q is of an order dividing gcd(hr, h2r) or equivalentlygcd(h1r, h2r). Hence Q is of order r under the condition gcd(h1, h2) = 1, which4is a test involving only the curve parameter u. Given that h1 = u − 1 and thecofactor h2 in this case is [2]h2 = (u8 − 4u7 + 5u6 − 4u4 + 6u3 − 4u2 − 4u+ 13)/9it is straightforward to use a tool like SageMath [17] to calculate the poly-nomial GCD, and hence confirm that this condition is true, and indeed thath2 mod h1 = 1 so that the condition is true for all candidate u = 1 mod 3. Wenote that the simple condition that gcd(h1, h2) = 1 may not be true for otherfamilies of pairing friendly curves. But it does apply also to BLS-24 and BLS-48curves.Next we describe how to calculate pQ using the p-power Frobenius on theBLS-12 curve. Clearly in doing so we need to be careful not to make any as-sumptions about the order of Q. As described in [9] the endomorphism ψ(Q)is formed by untwisting the candidate point to the curve E(Fp12), applying thep-power Frobenius, and restoring the point back to the twisted curve. We knowthat for any point Q the endomorphism satisfies ψ2(Q) − tψ(Q) + pQ = O [6],from which we derive pQ = ψ(tQ) − ψ2(Q) = ψ(uQ) + ψ(Q) − ψ2(Q). So theendomorphism test for group membership involves checking thatψ(uQ) + ψ(Q)− ψ2(Q) = uQThe two solutions to this quadratic are ψ(Q) = uQ and ψ(Q) = Q. Sincethe p-power Frobenius does not act trivially on any extension of Fp, the lattercase will not arise. Therefore the endomorphism test becomes simply a matterof confirming that ψ(Q) = uQ.Finally we observe that in the process of computing an optimal pairing [18],the value of uQ is implicitly calculated. Therefore in this context the groupmembership of Q can be assured with nearly zero extra cost.5 The GT caseA BLS-12 pairing evaluates as a element in the finite extension field Fp12 . If thiselement is of order r then it is a member of GT . Consider an element w whichpurports to be a member of GT . Assume that the cyclotomic test (see above)has already been carried out to quickly eliminate a large class of non-members.Again we know that the endomorphism should hold for w, and we can use the ppower Frobenius to check that wp = wu at the primary cost of an exponentiationby u. This confirms that wp−u = wp+1−t = 1. Therefore w has an order dividingh1r. But it also has an order that divides hT r. So again if gcd(h1, hT ) = 1 weknow that w must be of order r. As before we find that hT mod h1 = 1, and sofor BLS-12/24/48 curves this condition is always met.6 The G1 caseIn the case of G1 we take a different approach. The GLV endomorphism as itapplies to a point P = (x, y) on a BLS12 curve is5ψ(P ) = (βx, y) = −u2Pwhere β is a cube root of unity modulo p. So the first thing to do is to checkthat the endomorphism is true for our candidate point P . If it is not, then wecan confidently conclude that P is not of order r, and we are done. But we cango further and prove that if the endomorphism is true, then P must be of orderr. 1We offer proof by contradiction. Recall that −u2 is a cube root of unitymodulo the order. Therefore−u6 = 1 mod rIf the endomorphism were also true for a point of order c.r, where c is somedivisor of h1, then we would also have−u6 = 1 mod c.rWhich by the Chinese Remainder Theorem implies that−u6 = 1 mod cHowever we know that for a BLS curve c|h1 so c|(u− 1), thereforeu6 = (u mod c)6 = 16 = 1 mod cwhich is a contradiction. Furthermore there is an “early out” optimizationpossible for points of an order c that divides u− 1, as in that case (u− 1)P = Oand uP = P . If in the course of calculating −u2P it is observed that thiscondition is met, then P is not of order r and we can exit immediately, reportingfailure.While this method is faster than point multiplication by the group order,it will be slower than processing an input by simply clearing the cofactor andmultiplying it by h1.7 DiscussionCompared with the effort necessary to prove group membership by multiply-ing/exponentiating by r, these methods are ×2 faster in G1, and ×4 faster inG2 and GT for BLS-12 curves. For BLS-24 and BLS-48 curves the advantage isthe same in G1, and ×8 and ×16 respectively for the other two groups..On prime order BN curves [4], which are often considered as competitivewith BLS-12 curves, no testing at all is required for G1 membership, but the GT1 Beware the tautological argument rP = (u4 − u2 + 1)P = ψ2(P ) + ψ(P ) + P as afast means to check that rP = O. The endomorphism only holds if P is of order r,which is what we are trying to establish.6case requires exponentiation to the power of 6u2 (see [16] section 8.2), for onlya ×2 advantage in GT (and G2).Indeed these new membership tests are so efficient it calls into question therequirement for BLS pairing-friendly curves to be GT and G2 strong [16], [2],conditions which, certainly in combination, severely constrain our ability to findnice curves. Recall that being both G2 and GT strong means that h2 and hTshould be prime, such that no small subgroups exist. That group membershiptests become redundant in these cases is only partially true. The G1 case stillneeds to be dealt with for BLS curves, and in the GT case candidate elementsstill need to be pre-screened with a cyclotomic test.But there is one very plausible scenario where the cost of subgroup member-ship testing becomes significant – that of pairing delegation [1]. Here any extracost associated with a GT membership check adds to the overall cost for a poorlyendowed processor that has delegated the expensive pairing calculation to a morepowerful (but untrusted) server. In this case it would still be advantageous forthe curve to be GT strong.8 ConclusionBefore accepting an input to a pairing-based protocol (based on BLS curves) thatpurports to be a member of G1, G2 or GT , then the following is recommended.– In the case of G1 and G2, check that the elliptic curve point is actually onthe correct curve.– In the case of G1 multiply it by the cofactor h1. If it becomes the point-at-infinity, abort. Protocol designers should be aware that inputs in G1 willundergo such preprocessing.– In the case of GT , subject the input to the “cyclotomic test”, and abort onfailure.– In the cases of G2 and GT , subject the input to the appropriate endomor-phism test as described above. But this may not be necessary if the curve isknown to be G2 and/or GT strong. It may also not be necessary for the G2case if the candidate point is to be used an input to an optimal pairing.We note that in all cases the price for group membership assurance is at mostthat of a simple multiplication/exponentiation by the curve parameter u.AcknowledgmentsThe author is grateful to Francisco Rodriguez-Henriquez, Steven Galbraith,Diego Aranha, Kobi Gurkan and Antonio Sanso for providing valuable feed-backon earlier drafts of this work.7References1. D. F. Aranha, E. Pagnin, and F. Rodriguez-Henriquez. LOVE a pairing. Cryp-tology ePrint Archive, Report 2021/1029, 2021. http://eprint.iacr.org/2021/1029.2. P. S. L. M. Barreto, C. Costello, R. Misoczki, M. Naehrig, G. Pereira, and G. Zanon.Subgroup security in pairing-based cryptography. In LATINCRYPT, volume 9230of Lecture Notes in Computer Science, pages 245–265. Springer-Verlag, 2015.3. P.S.L.M. Barreto, B. Lynn, and M. Scott. Constructing elliptic curves with pre-scribed embedding degrees. In Security in Communication Networks – SCN 2002,volume 2576 of Lecture Notes in Computer Science, pages 257–267. Springer-Verlag, 2003.4. P.S.L.M. Barreto and M. Naehrig. Pairing-friendly elliptic curves of prime order.In Selected Areas in Cryptology – SAC 2005, volume 3897 of Lecture Notes inComputer Science, pages 319–331. Springer-Verlag, 2006.5. J. Bos, C. Costello, and M. Naehrig. Exponentiating in pairing groups. CryptologyePrint Archive, Report 2013/458, 2013. http://eprint.iacr.org/2013/458.6. S. Bowe. Faster subgroup checks for BLS12-381. Cryptology ePrint Archive, Report2018/814, 2018. http://eprint.iacr.org/2018/814.7. A. Budroni and F. Pintore. Efficient hash maps to G2 on bls curves. ApplicableAlgebra in Engineering, Communication and Computing, 2020. https://eprint.iacr.org/2017/419.pdf.8. S. Galbraith, K. Paterson, and N. Smart. Pairings for cryptographers. DiscreteApplied Mathematics, 156:3113–3121, 2008.9. S. Galbraith and M. Scott. Exponentiation in pairing-friendly groups using homo-morphisms. In Pairing 2008, volume 5209 of Lecture Notes in Computer Science,pages 211–224. Springer-Verlag, 2008.10. R. Gallant, R. Lambert, and S. Vanstone. Faster point multiplication on ellipticcurves with efficient endomorphism. In Crypto 2001, volume 2139 of Lecture Notesin Computer Science, pages 190–200. Springer-Verlag, 2001.11. M. Hamburg. Decaf: Eliminating cofactors through point compression. In Crypto2015, volume 9215 of Lecture Notes in Computer Science, pages 705–723. Springer-Verlag, 2015.12. D. Hayashida, K. Hayasaka, and T. Teruya. Efficient final exponentiation viacyclotomic structure for pairings over families of elliptic curves. Cryptology ePrintArchive, Report 2020/875, 2020. http://eprint.iacr.org/2020/875.13. F. Hess, N. Smart, and F. Vercauteren. The eta pairing revisited. IEEE Transac-tions on Information Theory, 52:4595–4602, 2006.14. C. H. Lim and P. J. Lee. A key recovery attack on discrete log-based schemesusing a prime order subgroup. In Crypto 1994, volume 1294 of Lecture Notes inComputer Science, pages 249–263. Springer-Verlag, 1994.15. N. El Mrabet and M. Joye, editors. Guide to Pairing-Based Cryp-tography. Chapman and Hall/CRC, 2016. https://www.crcpress.com/Guide-to-Pairing-Based-Cryptography/El-Mrabet-Joye/p/book/9781498729505.16. M. Scott. Unbalancing pairing-based key exchange protocols. Cryptology ePrintArchive, Report 2013/688, 2013. http://eprint.iacr.org/2013/688.17. The Sage Developers. SageMath, the Sage Mathematics Software System (Version9.0.0), 2020. https://www.sagemath.org.818. F. Vercauteren. Optimal pairings. IEEE Transactions of Information Theory,56:455–461, 2009. https://eprint.iacr.org/2008/096.19. R. Wahby and D. Boneh. Fast and simple constant-time hashing to the BLS12-381 elliptic curve. Cryptology ePrint Archive, Report 2019/403, 2019. http://eprint.iacr.org/2019/403.9

A note on group membership tests for \G_1, \G_2 and \G_T on BLS pairing-friendly curves

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive