Computationally Efficient Pairing-Friendly Curves for a 128bit Security Level

Barbulescu et al. conducted a study to estimate the security of pairings using the SexTNFS method. They found that the BLS curve is a more suitable option for achieving 128-bit security, whereas the commonly used BLS12_381 curve in zk-SNARK falls slightly short of this level. ISO/IEC standard BLS12-461 curve, which provides 131-bit security, is nearly twice as slow in computation efficiency compared to the BLS12-381 curve. In this paper, we propose a new curve parameter, BLS12-383, by considering four factors that impact the computational complexity of bilinear pairings: the hamming weight of the key parameter, tower extension field, curve equation, and the type of twist. Using optimal ate pairing , our proposed curve improves computational efficiency by 5% compared to BLS12-381, while maintaining 128-bit security strength. Furthermore, it demonstrates double the efficiency of the ISO/IEC standard BLS12-461 curve.