Subgroup size measures the bit length of a large prime factor, usually r, within an elliptic-curve group’s cardinality. In pairing-based designs, it helps compare security requirements across prime fields and extension fields. section 14.1
The rho ratio compares field-prime size with subgroup size: rho = log₂(p) / log₂(r). Smaller ratios indicate less field-size overhead; pairing-friendly curve families can therefore reduce resources at higher security levels. section 14.1
Table 14.1 Elliptic curve field sizes for pairings
| Security level | Subgroup size | Extension field | Embedding degree |
|---|---|---|---|
| 80 | 160 | 960–1280 | 6–8 |
| 112 | 224 | 2200–3600 | 10–16 |
| 128 | 256 | 3000–5000 | 12–20 |
| 192 | 384 | 8000–10000 | 20–26 |
| 256 | 512 | 14000–18000 | 28–36 |
Use the table to compare security levels with subgroup sizes, extension-field sizes, and embedding degrees. section 14.1
