ρ measures the size overhead between the finite-field prime p and the large prime subgroup factor r in pairing-friendly elliptic-curve construction. It is defined by ρ = log₂(p) / log₂(r), so it compares field-modulus bits with subgroup-order bits while security requirements determine the relevant sizes. section 14.1
A pairing-curve search uses ρ alongside related size and security quantities:
- The subgroup-size column counts bits in the large prime factor r of the curve cardinality. section 14.1
- A sweep accepts a maximum bit-size input for r, tests candidate parameters, and reports the resulting p-to-r ratio. section 14.5.1
Reported sweep values
For k = 13, one candidate has r with 62 bits, q with 76 bits, and ρ = 1.225806; another has 102-bit r, 125-bit q, and ρ = 1.225490. A larger candidate reports 226-bit r, 280-bit q, and ρ = 1.238938. section 14.5.1
Table 14.1 Elliptic curve field sizes for pairings
| Security level | Subgroup size | Extension field | Embedding degree |
|---|---|---|---|
| 80 | 160 | 960–1280 | 6–8 |
| 112 | 224 | 2200–3600 | 10–16 |
| 128 | 256 | 3000–5000 | 12–20 |
| 192 | 384 | 8000–10000 | 20–26 |
| 256 | 512 | 14000–18000 | 28–36 |
Compare subgroup and extension-field bit sizes across security levels, then relate those sizes to embedding degree; ρ supplies the omitted base-field-to-subgroup comparison. section 14.1
