Comments about section 4.2.1 (from 2nd Expert Review)

[yumi-sakemi]

Comments from Chloe (Expert Reviewer)

• This comment is maybe a bit misleading: 'We have to note that, according to [BD18], the bit length of p for BLS12 to achieve 128-bit security is calculated as 461 bits and more, which BLS12_381 does not satisfy.' The 461-bit figure in [BD18] is based on a rough estimate which varies a lot between different examples (as is necessary when giving a broad overview). The exact complexity of [BD18]'s attack depends on the specific polynomial used to construct the family and can change the complexity of the attack by up to about 12 bits. The proposed construction of BLS12_381 you refer to here has been specially chosen to minimize the impact of the exTNFS attack. It would in my opinion be more precise to say: 'We have to note that the security level of this pairing is expected to be 126 rather than 128 bits [GMT19]'.

[yumi-sakemi]

I adopted it because Chloe's expression is more appropriate.

[Tsune3110]

OK!

This is a cross-check as a co-author.

[yumi-sakemi]

Thank you for your checking :-) I close this issue!