BLS Curves with Embedding Degrees 9, 15, 21 and 27 against Small-Subgroup Attacks

Pairing Based Cryptography depends on the existence of groups where the DDH problem is easy to solve but the problem CDH is difficult. Barreto, Lynn, and Scott examined criteria for curves of larger embedding degrees that generalize the prior work of Miyaji et al. based on the properties of cyclotomic polynomials. To achieve an average level of security, at least two of the three groups of the pairing must necessarily be subgroups proper to groups of orders composed of large prime factors to resist of the small-subgroup attacks. In this article, we have taken over the article of Barreto, Lynn and Scott by bringing clarifications at the level of some basic formulas, by bringing correctives to the case of power of 3 and adding the general case divisible by 3. This theory has been applied to see its impact on the security of the subgroups in pairing-based cryptography.