Score:2

Weaknesses in pairing crypto with BN curves

us flag

Are there any known weaknesses in Barreto-Naehrig Curves (e.g. BN P256) ?

Score:4
ru flag

It depends on what qualifies as a weakness. The Barreto-Naehrig family has significantly less security than was originally believed when the construction was first presented in 2005. At that time it was hoped that BN256 would have security roughly equivalent to the NIST P256 curve (i.e. approximately $2^{128}$ elliptic curve operations would be needed to recover a private key). However, work by Kim and Barbulescu on the Extended Tower Number Field Sieve (XTNFS) found an attack that takes about $2^{100}$ operations according to costing by Barbulescu and Duquesne. Note that $2^{100}$ operations is still considered infeasible for this sort of attack, but does indicate that the secure lifetime of BN256 is probably shorter than NIST P256.

There's also the problem with all elliptic curve/pairing-based cryptography that the construction is not quantum resistant. Roeteller et al. provide a detailed quantum costing for curves of this size that use 2330 logical quantum qubits. This number of logical qubits could perhaps be realised using $317\times 10^6$ physical qubits of a certain quality running for one hour per work by Webber et al.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.