Groups of unknown order are of major interest due to their applications including time-lock puzzles, verifiable delay functions, and accumulators. In this paper we focus on trustless setup: in this setting, the most popular unknown-order group construction is ideal class groups of imaginary quadratic fields. We argue that the full impact of Sutherland's generic group-order algorithm has not been recognised in this context, and show that group sizes currently being proposed in practice (namely, approximately 830 bits) do not meet the claimed security level. Instead, we claim that random group orders should be at least 3300 bits to meet a 128-bit security level. For ideal class groups this leads to discriminants of around 6656 bits, which are much larger than desirable. One drawback of class groups is that current approaches require approximately $2\log_2(N)$ bits to represent an element in a group of order N. We provide two solutions to mitigate this blow-up in the size of representations. First, we explain how an idea of Bleichenbacher can be used to compress class group elements to $(3/2)\log_2(N)$ bits. Second, we note that using Jacobians of hyperelliptic curves (in other words, class groups of quadratic function fields) allows efficient compression to the optimal element representation size of $\log_2(N)$ bits. We discuss point-counting approaches for hyperelliptic curves and argue that genus-3 curves are secure in the trustless unknown-order setting. We conclude that in practice, Jacobians of hyperelliptic curves are more efficient in practice than ideal class groups at the same security level -- both in the group operation and in the size of the element representation.
翻译:身份不明的组群因其应用程序( 包括时间锁定拼图、 可核实的延迟功能和累积器) 而引起重大兴趣。 在本文中, 我们关注的是无信任的设置 。 在这种环境下, 最受欢迎的未知组群构建是想象的二次曲线字段的理想类组 。 我们争论说, 萨瑟兰的通用群集序列算法在此背景下尚未被识别到全部影响, 并表明在实践中提议的群体规模( 约830比特) 不符合所声称的安全级 。 相反, 我们声称随机组群点应该至少为3300比特, 以满足128比特的安全级 。 对于理想类组群来说, 这会导致大约6656比特的相异类群群群群群群构建, 远远大于想象的二次类组群群群群 。 我们提供两种解决方案来减轻这个比例的冲击。 我们解释一下, Bleechenbacher 的想法是如何用来将类组的组群落元素压缩成 $( 3/2) 3\\\\\ log_ clas laus laus lax lax ficial ladeal lab lax lax lax lax lax lax laus lax lax lax lax lax lax lax lax laut lax laut lauts lax laut lax lax lax lax lax lax lax lax lax lax lax lax laus lax lax lax lax lax lax lax lax lax lauts laut lax lauts lauts lax laut laut laut laut laut lax lauts lax lax lax lauts laut lax lax lax lax lax laut lax lax lax lax lax lax lax lax lax lax lax lax laus lax lax lax