A security level estimates the computational work required to defeat a cryptographic system, commonly using bits. In elliptic-curve pairing design, the target level determines field sizes and embedding degrees. section 14.1
For elliptic-curve systems, security comparisons depend on the attack setting:
- The elliptic-curve discrete logarithm problem requires work proportional to the square root of the base-point order, so an elliptic-curve key is roughly twice the bit length of an equivalent symmetric key. section 14.1
- Pairing applications must protect both the base curve and its field extension, because extension-field attacks are treated as subexponential and may require larger parameters. section 14.1
- The ratio rho compares field-prime size p with subgroup size r: rho = log2(p) / log2(r). section 14.1
Table 14.1 Elliptic curve field sizes for pairings
| Security level | Subgroup size | Extension field | Embedding degree |
|---|---|---|---|
| 80 | 160 | 960–1280 | 6–8 |
| 112 | 224 | 2200–3600 | 10–16 |
| 128 | 256 | 3000–5000 | 12–20 |
| 192 | 384 | 8000–10000 | 20–26 |
| 256 | 512 | 14000–18000 | 28–36 |
Use the parameter table to compare symmetric security levels with subgroup sizes, extension-field sizes, and embedding degrees. section 14.1
