Pairing-friendly curves suitable for cryptography (k=6, ρ=1)

The table below lists ordinary elliptic curves defined over a prime field Fp with 171 < log2(p) < 192. Each curve has prime order N and embedding degree k=6 (i.e. p6 is congruent to 1 mod N and no smaller power of p has this property). These parameters yield a pairing-friendly curve at or above the 80-bit security level (See Freeman, Scott, and Teske, A taxonomy of pairing-friendly curves, 2006).

The data is organized according to the negative fundamental discriminant D satisfying 4p=t2v2D, where N=p+1-t. The endomorphism ring of the corresponding curve is isomorphic to the imaginary quadratic order with discrminant D (the ring of integers of the number field Q[√D], since D is fundamental). Attached to each entry is a file containing a complete list of all such curves (up to isomorphism).

The values of D were obtained using the method of Karabina and Teske described in On prime-order elliptic curves with embedding degree 3, 4, and 6, ANTS VIII, (2008). The curves were constructed by computing the Hilbert class polynomial modulo p, using the algorithm described in Computing Hilbert class polynomials with the Chinese Remainder Theorem.

We present only a sampling of results here, with discriminants ranging up to ≈ 1014. In total, there are nearly 500 discriminants satisfying the parameters above with |D|< 1012, and more than 1700 with |D|< 1013.

Class GroupCurve Parameters
D = -28,894,627 p = 187784978581364795053676264791802673448783748203210001 (177 bits)
h(D) = 724 t = 433341641873204697735463901
y2 = x3− 3x + 164408489903399677437574775763245184665784485103109715
File EC28894627.txt
D = -116,799,691 p = 144476043753595291180666302380390305633698093657532145957 (187 bits)
h(D) = 2,112 t = 12019818790380963608542103867
y2 = x3− 3x + 35665820202118249463188568019652499120926813052973740146
File EC116799691.txt
D = -145,196,139 p = 34597786650769143491213719016894246041095097673960677 (175 bits)
h(D) = 2,752 t = -186004802762641436831269973
y2 = x3− 3x + 8568882325012180161226953878317372574812643665913434
File EC145196139.txt
D = -147,802,267 p = 205348623435953197305213996633141546392069795003984677 (178 bits)
h(D) = 1,276 t = -453154083547697049002692025
y2 = x3− 3x + 77104667459658235763233079995849479544261387236203923
File EC147802267.txt
D = -228,099,523 p = 373200510977065068849796572997146301596321013569444097 (178 bits)
h(D) = 1,296 t = 610901392187859618442730065
y2 = x3− 3x + 309981546858663639964882568270113130734247019456526720
File EC228099523.txt
D = -298,430,371 p = 534773951988931769658451527361661581767404484136574017 (179 bits)
h(D) = 3,069 t = -731282402351466248968290503
y2 = x3− 3x + 127684628895920344871204352318116052034664050931669307
File EC298430371.txt
D = -374,337,667 p = 84745187064331031938336698903905428615581220009620901 (176 bits)
h(D) = 2,108 t = 291110266161004758094677031
y2 = x3− 3x + 33585313308912780872218905609887214134986010613736868
File EC374337667.txt
D = -615,602,347 p = 4264320076670585843318184247715774964157840175227457 (172 bits)
h(D) = 5,509 t = 65301761665904434031185385
y2 = x3− 3x + 3833202321982171327759993370864038711240128442280136
File EC615602347.txt
D = -674,634,067 p = 9596506762631342257317946996637828559091628006031726917 (183 bits)
h(D) = 4,085 t = -3097822906918880386843134445
y2 = x3− 3x + 3071400209918294712550710458321701813802748621236062988
File EC674634067.txt
D = -765,184,467 p = 1654012424849975862417343119863965322038922658815348737 (181 bits)
h(D) = 5,056 t = -1286084143767419232859793855
y2 = x3− 3x + 1255064163666910932036927186545562356982442190942188706
File EC765184467.txt
D = -835,218,403 p = 1401349071989426636325921896247713308949105992644180901 (180 bits)
h(D) = 4,100 t = 1183785906314746862777253031
y2 = x3− 3x + 128968830060799686137165319262954498820425605301865805
File EC835218403.txt
D = -1,218,951,379 p = 5548459490173142493234510877521016901209628725607057 (172 bits)
h(D) = 6,320 t = -74487982186210028206700083
y2 = x3− 3x + 2861080600502970654667579914392081559752177933263596
File EC1218951379.txt
D = -1,416,241,171 p = 6015941539365775071785097258236758532634077067574443397 (182 bits)
h(D) = 5,098 t = -2452741637304217794524386913
y2 = x3− 3x + 3510643464105272927056037937714195696287062190483016707
File EC1416241171.txt
D = -1,611,918,043 p = 81308659748347271006407969275494383070287122113917637 (176 bits)
h(D) = 4,764 t = 285146733715024817582510195
y2 = x3− 3x + 68634090957174143540006252905005466383467205780555830
File EC1611918043.txt
D = -1,739,525,923 p = 152573394109000144285336266970389873986350750004460569797 (187 bits)
h(D) = 4,315 t = -12352060318384141710648854285
y2 = x3− 3x + 148867910752760182161655351381379466252345166508800299690
File EC1739525923.txt
D = -1,778,975,339 p = 39808319092849527126413494767817062589037029748183617 (175 bits)
h(D) = 12,324 t = 199520222265437362674838297
y2 = x3− 3x + 12495370028231289096030287843622422843380510615082979
File EC1778975339.txt
D = -1,842,794,363 p = 6841494608034469881189251633975086856064938336604817 (173 bits)
h(D) = 8,128 t = 82713327874257785065655605
y2 = x3− 3x + 2266849780447105783095707038627832864553703736251828
File EC1842794363.txt
D = -2,302,080,411 p = 191726639199423459103694098914824813267323148398080793477 (187 bits)
h(D) = 10,152 t = -13846538888813458971272431073
y2 = x3− 3x + 86294145730440406058489045185272655581996723117606805993
File EC2302080411.txt
D = -2,580,743,523 p = 9389148318834626885028435538065694226902550427332677 (173 bits)
h(D) = 8,384 t = 96897617714960499874108975
y2 = x3− 3x + 1634000987205220268537216060270275526061628238175879
File EC2580743523.txt
D = -2,731,929,523 p = 32376341025341912137209581539281379758419807487667601 (175 bits)
h(D) = 4,896 t = -179934268624244870764494739
y2 = x3− 3x + 21982462147386627798384194361520369194511344618479456
File EC2731929523.txt
D = -2,865,735,203 p = 359438889403021949781363771794397521577925829465674897 (178 bits)
h(D) = 10,872 t = -599532225491692773094558835
y2 = x3− 3x + 39281237469521623513143296026036648185306745118464604
File EC2865735203.txt
D = -3,258,436,963 p = 11131268343536159990791729534032636418108644070650351617 (183 bits)
h(D) = 7,412 t = -3336355548129749313932367295
y2 = x3− 3x + 4449487876187119995440068416813232965777262770434667724
File EC3258436963.txt
D = -3,313,362,219 p = 130956630607414879633763933428225451876970608991329043457 (187 bits)
h(D) = 18,318 t = -11443628384713254032264772383
y2 = x3− 3x + 106532174595915162767660475218729905426765062420773980907
File EC3313362219.txt
D = -3,575,764,819 p = 1093610312093340379356533501036616131946963743161774657 (180 bits)
h(D) = 9,676 t = -1045758247442180290145495783
y2 = x3− 3x + 921254125210789022931668225263294746770547432323050255
File EC3575764819.txt
D = -3,792,453,563 p = 2485250440952853070258558062943697172913931242144497937 (181 bits)
h(D) = 18,808 t = -1576467710088872410285732955
y2 = x3− 3x + 875606644028977104683157922187740120954682147392795165
File EC3792453563.txt
D = -3,871,696,627 p = 38208885697293853794294355038541951311453875802579601 (175 bits)
h(D) = 7,257 t = 195470933126370105314647861
y2 = x3− 3x + 22068898039757632279767654653039086990206257095379072
File EC3871696627.txt
D = -4,508,791,627 p = 397148915339905003478441958194242906936544636506904496401 (189 bits)
h(D) = 7,867 t = 19928595418139859549494076581
y2 = x3− 3x + 349180890177256954923596789986918041783072851170664092195
File EC4508791627.txt
D = -5,267,595,027 p = 12671329072132069110468132673802703707056268562020101 (174 bits)
h(D) = 12,732 t = -112566998148356381896488509
y2 = x3− 3x + 4348735474812574707030242444017009444654821740796519
File EC5267595027.txt
D = -5,741,754,411 p = 19340885716753844220013989435320789671427626449371557 (174 bits)
h(D) = 19,568 t = 139071512959174511958992167
y2 = x3− 3x + 10050713365537082582879814015121418931887996362479488
File EC5741754411.txt
D = -6,032,002,083 p = 1681795183071163555777938290413093794723017681526632101 (181 bits)
h(D) = 16,164 t = -1296840461688007155841116389
y2 = x3− 3x + 521072373022899270209456030618683763824940714028656034
File EC6032002083.txt
D = -7,396,794,203 p = 52906940113078789177540995105624927999429466112221032901 (186 bits)
h(D) = 16,941 t = 7273715701969577885320824271
y2 = x3− 3x + 52199261351723577285283092250212276100143312136648400219
File EC7396794203.txt
D = -7,712,378,923 p = 1414214638943340645392331051451186118710635774223083557 (180 bits)
h(D) = 12,244 t = 1189207567644665068792291835
y2 = x3− 3x + 438772784406434403177833212256743889477709459573222640
File EC7712378923.txt
D = -9,177,974,187 p = 257891496788164045765241357836708044625487846107562917 (178 bits)
h(D) = 16,600 t = -507830184991168131099929945
y2 = x3− 3x + 16427738793636200038565830839154647875009221684328451
File EC9177974187.txt
D = -10,139,079,763 p = 193720004421698250758514547898563702261630269284488272101 (187 bits)
h(D) = 10,218 t = 13918333392389271645863554391
y2 = x3− 3x + 123398441236557539781020484579788906163108176476358333402
File EC10139079763.txt
D = -10,584,680,019 p = 5398753790240354089203838875953001959584288047747408037 (182 bits)
h(D) = 22,488 t = 2323521850605316362494596507
y2 = x3− 3x + 2714123137218543525164620826105891341405868391380748350
File EC10584680019.txt
D = -12,382,091,443 p = 450781362440926289250742214051968811457728576210002177 (179 bits)
h(D) = 12,032 t = -671402533835646385290325775
y2 = x3− 3x + 333473120788026194291237327982209179392814081565761388
File EC12382091443.txt
D = -12,901,800,539 p = 3410199202204433999880021199504803890803471201072357 (172 bits)
h(D) = 54,076 t = 58396910896077662302036567
y2 = x3− 3x + 2512984004466956660360837681921214847611812034605157
File EC12901800539.txt
D = -13,569,850,003 p = 180749959183137855596679888665667670209785208393292901 (177 bits)
h(D) = 20,203 t = 425146985386392991176193271
y2 = x3− 3x + 130189332274435690357531482513641166897647339027520573
File EC13569850003.txt
D = -13,791,736,947 p = 81952781409276665271694592694398768563868394516488924737 (186 bits)
h(D) = 25,312 t = 9052777552181245620408333145
y2 = x3− 3x + 70843687365418530301630199851223455325912571202590907786
File EC13791736947.txt
D = -13,977,210,083 p = 235207757939146536495173907518051133473494854534999436357 (188 bits)
h(D) = 20,944 t = -15336484536527480765260026065
y2 = x3− 3x + 206095428557926664926697079050525933491062771211295449441
File EC13977210083.txt
D = -14,901,457,803 p = 2595360413588760174505345781890346512094344012461800101 (181 bits)
h(D) = 14,148 t = -1611012232600597038218090009
y2 = x3− 3x + 1118306233228646827608565850131464489651013207986915003
File EC14901457803.txt
D = -15,791,338,243 p = 477300117749552479496218717195792271288147198321771362277 (189 bits)
h(D) = 14,796 t = -21847199311343147067998590825
y2 = x3− 3x + 351333769307765433455969117573125905818136009138526631957
File EC15791338243.txt
D = -16,468,533,307 p = 33689378073009274218648278821916876229825674274971537 (175 bits)
h(D) = 12,710 t = 183546664565197899481299245
y2 = x3− 3x + 17192397727422619116791771076682304120052701578111034
File EC16468533307.txt
D = -17,237,858,107 p = 734457211384163097629443035784325447167812389307249937 (179 bits)
h(D) = 14,064 t = 857004790759166700254446045
y2 = x3− 3x + 581925790916900551758498271872631711462976260921974913
File EC17237858107.txt
D = -18,696,224,163 p = 273326145157283418801395829065986816747101028798035601 (178 bits)
h(D) = 20,160 t = -522806030146251678447555659
y2 = x3− 3x + 182847115799865025123132514402504589929095797267598441
File EC18696224163.txt
D = -19,123,969,243 p = 7288158783896122690374926419002937944154973968102501 (173 bits)
h(D) = 17,504 t = -85370713853733955352541449
y2 = x3− 3x + 4923208273935823882099333060416665844325194141188730
File EC19123969243.txt
D = -20,032,919,187 p = 43963472699523962924557957513752125102652244157689116901 (185 bits)
h(D) = 23,556 t = -6630495660169303129031027369
y2 = x3− 3x + 2632288574928643729386408237367421526720986163304753240
File EC20032919187.txt
D = -21,265,341,099 p = 161108870846916050635611987988672521138728986787213377 (177 bits)
h(D) = 25,764 t = 401383695292815862325786377
y2 = x3− 3x + 112931509533949268174780382847937675604978836587913072
File EC21265341099.txt
D = -21,270,597,067 p = 11651078075548029512142873317730158207277146145596417 (173 bits)
h(D) = 17,615 t = -107940159697621485000161695
y2 = x3− 3x + 9404764304291741503220078118719955361084852142078103
File EC21270597067.txt
D = -21,517,778,883 p = 54980716927944792131925518161677704963503517887551858757 (186 bits)
h(D) = 36,240 t = -7414898308671858793850509265
y2 = x3− 3x + 36407850562961182125092089673333553942375157718872808397
File EC21517778883.txt
D = -22,129,294,907 p = 7597211622382317572196503125234739700152067290703937 (173 bits)
h(D) = 37,156 t = -87161984961233630525358455
y2 = x3− 3x + 5655194902275202376750717891628715224542445376991235
File EC22129294907.txt
D = -22,740,715,659 p = 338667530990706731069200398246423925441285620642424357 (178 bits)
h(D) = 39,136 t = 581951485083341574480435067
y2 = x3− 3x + 36282519969956885701705662944309033209663376591316937
File EC22740715659.txt
D = -24,309,679,299 p = 450623968056058471269675720125659619578299268966759432357 (189 bits)
h(D) = 47,038 t = -21227905409061405351551233433
y2 = x3− 3x + 328038965707340512158544442726086692075820345454736248461
File EC24309679299.txt
D = -24,389,834,523 p = 128040309223200296740188607732126950255155456239468544401 (187 bits)
h(D) = 30,496 t = 11315489791573332365567590381
y2 = x3− 3x + 100141629820832965522172766147368023015781205846540788592
File EC24389834523.txt
D = -25,280,303,323 p = 670777582775161182876891448794395325711992621702572097 (179 bits)
h(D) = 18,848 t = -819010123731789522302018935
y2 = x3− 3x + 23079742963931744302206165998185290575914676965239545
File EC25280303323.txt
D = -25,739,819,211 p = 1559682693090934032863470063347719829503491692258577 (171 bits)
h(D) = 42,744 t = 39492818247004530948541477
y2 = x3− 3x + 989616319843766272446430933604494840088830931425520
File EC25739819211.txt
D = -25,897,099,243 p = 15507206137197834348027875800923236913659745195648101 (174 bits)
h(D) = 15,424 t = -124527933160387088904398089
y2 = x3− 3x + 9550807589462330144310920317319384390020298411927914
File EC25897099243.txt
D = -35,586,455,227 p = 129314466816722744377400343046396524551382919581051457 (177 bits)
h(D) = 18,481 t = 359603207461672600105953385
y2 = x3− 3x + 117737005003314089214532961441764670760504692714796697
File EC35586455227.txt
D = -44,829,658,339 p = 77407970514214176676669106429695959180797637342843877 (176 bits)
h(D) = 33,630 t = 278222879206966328663851627
y2 = x3− 3x + 62740582997382946087960746747707087036668991993159694
File EC44829658339.txt
D = -69,623,892,083 p = 7472594981967576643990934476952378515359701319614737 (173 bits)
h(D) = 56,760 t = 86444172631633051242775645
y2 = x3− 3x + 2538167210477462813808837214577711363083446251486606
File EC69623892083.txt
D = -135,112,130,651 p = 2619903220352537407488027139046893756696805650009489477 (181 bits)
h(D) = 139,152 t = 1618611510014845226044329427
y2 = x3− 3x + 1106047026154592613625189998594615573086405999913442833
File EC135112130651.txt
D = -137,472,195,531 p = 26384562695099445566471020440452680157158976379414232837 (185 bits)
h(D) = 129,520 t = -5136590571098639312541510593
y2 = x3− 3x + 25060751439163602263514393514995112515607802816722471646
File EC137472195531.txt
D = -275,022,600,899 p = 649119655491486034288068996512356428917539775381467420177 (189 bits)
h(D) = 247,002 t = -25477826741923770965332502723
y2 = x3− 3x + 206421783183860177573879708299897614237233005922934806314
File EC275022600899.txt
D = -553,555,955,779 p = 398667198218442790460567353359604686369715584728807946497 (189 bits)
h(D) = 122,992 t = -19966652153489397393753650863
y2 = x3− 3x + 275696291453767822343064218416724895653386707496642886430
File EC553555955779.txt
D = -905,270,581,331 p = 755557337300842682610644248837145749326209815955343146257 (189 bits)
h(D) = 391,652 t = 27487403247684978120028215517
y2 = x3− 3x + 337111454964792524820535491675483603358128203108143837712
File EC905270581331.txt
D = -1,006,819,828,491 p = 6542359233793215611987760383976447340185513136162215697 (183 bits)
h(D) = 180,616 t = 2557803595625202731134030237
y2 = x3− 3x + 2171821286009483629534519778719800875925195331312121985
File EC1006819828491.txt
D = -1,009,088,517,019 p = 501979768448459397910696231715444885425065844662485477 (179 bits)
h(D) = 181,584 t = -708505305871776374455447573
y2 = x3− 3x + 22996263450766704822964907169817712276096755062514490
File EC1009088517019.txt
D = -1,075,293,904,883 p = 1346641873210256825002835293472783964530120144943181616101 (190 bits)
h(D) = 237,138 t = 36696619370321523188073603691
y2 = x3− 3x + 504301373576436494288171129456920924955358066779657677616
File EC1075293904883.txt
D = -1,637,050,295,459 p = 3188658887163175280785298751538765815956603007327397 (172 bits)
h(D) = 629,926 t = -56468211297713116784877413
y2 = x3− 3x + 2625685427802410547346563291323031124792769328294690
File EC1637050295459.txt
D = -5,346,169,347,059 p = 87951109067485472439439611550278373642396071181030417 (176 bits)
h(D) = 1,111,768 t = -296565522384995846366823803
y2 = x3− 3x + 58470200718584104416403812859046567722414630082730258
File EC5346169347059.txt
D = -10,079,075,298,779 p = 4024126345463346725676875974113018515470813447887937 (172 bits)
h(D) = 1,162,428 t = -63436001966260032627359543
y2 = x3− 3x + 2699720158941959132261005327267186294322307580627458
File EC10079075298779.txt
D = -102,197,306,669,747 p = 1317860422843322160610398725225958731902944552925978150597 (190 bits)
h(D) = 2,014,236 t = -36302347346188540382304940685
y2 = x3− 3x + 154344787563346744370152153588767287709323583533485442048
File EC102197306669747.txt