pairing alternatives and similar packages
Based on the "Cryptography" category.
Alternatively, view pairing alternatives based on common mentions on social networks and blogs.

merkletree
An implementation of a Merkle Tree and merkle tree proofs 
pedersencommitment
An implementation of Pedersen commitment schemes 
arithmeticcircuits
Arithmetic circuits for zero knowledge proof systems 
cryptohash
efficient and practical cryptohashing in haskell. DEPRECATED in favor of cryptonite 
oblivioustransfer
Oblivious transfer for multiparty computation 
cipherblowfish
DEPRECATED by cryptonite; A collection of cryptographic block and stream ciphers in haskell 
cipheraes
DEPRECATED  use cryptonite  a comprehensive fast AES implementation for haskell that supports aesni and advanced cryptographic modes. 
ellipticcurve
A polymorphic interface for elliptic curve operations 
ed25519
Minimal ed25519 Haskell package, binding to the ref10 SUPERCOP implementation. 
cryptoapi
Haskell generic interface (type classes) for cryptographic algorithms 
skein
Skein, a family of cryptographic hash functions. Includes SkeinMAC as well. 
qnapdecrypt
Decrypt files encrypted by the QNAP's Hybrid Backup Sync 
cryptohashsha256
Fast, pure and practical SHA256 implementation 
galoisfft
Finite field polynomial arithmetic based on fast Fourier transforms 
cryptopubkeytypes
Crypto Public Key algorithm generic types. 
cryptopubkey
DEPRECATED  use cryptonite  Cryptographic public key related algorithms in haskell (RSA,DSA,DH,ElGamal) 
signable
Deterministic serialisation and signatures with protolens and protobufelixir support 
cprngaes
Crypto Pseudo Random Number Generator using AES in counter mode 
cryptoenigma
A Haskell Enigma machine simulator with rich display and machine state details. 
cipheraes128
Based on cipheraes, but using a cryptoapi interface and providing resulting IVs for each mode 
cryptonumbers
DEPRECATED  use cryptonite  Cryptographic number related function and algorithms
* Code Quality Rankings and insights are calculated and provided by Lumnify.
They vary from L1 to L5 with "L5" being the highest.
Do you think we are missing an alternative of pairing or a related project?
Popular Comparisons
README
Implementation of the BarretoNaehrig (BN) curve construction from [BCTV2015] to provide two cyclic groups and , with an efficient bilinear pairing:
Pairing
Let , and be abelian groups of prime order and let and elements of and respectively . A pairing is a nondegenerate bilinear map .
This bilinearity property is what makes pairings such a powerful primitive in cryptography. It satisfies:
The nondegeneracy property guarantees nontrivial pairings for nontrivial arguments. In other words, being nondegenerate means that:
 such that
 such that
An example of a pairing would be the scalar product on euclidean space .
Example Usage
A simple example of calculating the optimal ate pairing given two points in and .
import Protolude
import Data.Group (pow)
import Data.Curve.Weierstrass (Point(A), mul')
import Data.Pairing.BN254 (BN254, G1, G2, pairing)
p :: G1 BN254
p = A
1368015179489954701390400359078579693043519447331113978918064868415326638035
9918110051302171585080402603319702774565515993150576347155970296011118125764
q :: G2 BN254
q = A
[2725019753478801796453339367788033689375851816420509565303521482350756874229
,7273165102799931111715871471550377909735733521218303035754523677688038059653
]
[2512659008974376214222774206987427162027254181373325676825515531566330959255
,957874124722006818841961785324909313781880061366718538693995380805373202866
]
main :: IO ()
main = do
putText "P:"
print p
putText "Q:"
print q
putText "e(P, Q):"
print (pairing p q)
putText "e(P, Q) is bilinear:"
print (pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b))
where
a = 2 :: Int
b = 3 :: Int
Pairings in cryptography
Pairings are used in encryption algorithms, such as identitybased encryption (IBE), attributebased encryption (ABE), (innerproduct) predicate encryption, short broadcast encryption and searchable encryption, among others. It allows strong encryption with small signature sizes.
Admissible Pairings
A pairing is called admissible pairing if it is efficiently computable. The only admissible pairings that are suitable for cryptography are the Weil and Tate pairings on algebraic curves and their variants. Let be the order of a group and be the entire group of points of order on . is called the rtorsion and is defined as . Both Weil and Tate pairings require that and come from disjoint cyclic subgroups of the same prime order . Lagrange's theorem states that for any finite group , the order (number of elements) of every subgroup of divides the order of . Therefore, .
and are subgroups of a group defined in an elliptic curve over an extension of a finite field , namely , where is the characteristic of the field and is a positive integer called embedding degree.
The embedding degree plays a crucial role in pairing cryptography:
 It's the value that makes be the smallest extension of such that captures more points of order .
 It's the minimal value that holds .
 It's the smallest positive integer such that .
There are subtle but relevant differences in and subgroups depending on the type of pairing. Nowadays, all of the stateoftheart implementations of pairings take place on ordinary curves and assume a type of pairing (Type 3) where and and there is no nontrivial map .
Tate Pairing
The Tate pairing is a map:
defined as:
where , is any representative in a equivalence class in and is the set of equivalence classes of under the equivalence relation . The equivalence relation in the output of the Tate pairing is unfortunate. In cryptography, different parties must compute the same value under the bilinearity property.
The reduced Tate pairing solves this undesirable property by exponentiating elements in to the power of . It maps all elements in an equivalence class to the same value. It is defined as:
When we say Tate pairing, we will mean the reduced Tate pairing.
Pairing optimization
Tate pairings use Miller's algorithm, which is essentially the doubleandadd algorithm for elliptic curve point multiplication combined with evaluation of the functions used in the addition process. Miller's algorithm remains the fastest algorithm for computing pairings to date.
Both and are elliptic curve groups. is a multiplicative subgroup of a finite field. The security an elliptic curve group offers per bit is considerably greater than the security a finite field does. In order to achieve security comparable to 128bit security (AES128), an elliptic curve of 256 bits will suffice, while we need a finite field of 3248 bits. The aim of a cryptographic protocol is to achieve the highest security degree with the smallest signature size, which normally leads to a more efficient computation. In pairing cryptography, significant improvements can be made by keeping all three group sizes the same. It is possible to find elliptic curves over a field whose largest prime order subgroup has the same bitsize as the characteristic of the field . The ratio between the field size and the large prime group order is called the value. It is an important value that indicates how much (ECDLP) security a curve offers for its field size. is the optimal value. The BarretoNaehrig (BN) family of curves all have and . They are perfectly suited to the 128bit security level.
Most operations in pairings happen in the extension field . The larger gets, the more complex becomes and the more computationally expensive the pairing becomes. The complexity of Miller's algorithm heavily depends on the complexity of the associated arithmetic. Therefore, the aim is to minimize the cost of arithmetic in .
It is possible to construct an extension of a field by successively towering up intermediate fields and such that , where and are usually 2 and 3. One of the reasons tower extensions work is that quadratic and cubic extensions ( and ) offer methods of performing arithmetic more efficiently.
Miller's algorithm in the Tate pairing iterates as far as the prime group order , which is a large number in cryptography. The ate pairing comes up as an optimization of the Tate pairing by shortening Miller's loop. It achieves a much shorter loop of length on an ordinary curve, where t is the trace of the Frobenius endomorphism. The ate pairing is defined as:
Implementation
We have implemented a polymorphic optimal ate pairing over the following pairingfriendly elliptic curves:
 BarretoLynnScott degree 12 curves
 [BLS12381](src/Data/Pairing/BLS12381.hs)
 BarretoNaehrig curves
 [BN254](src/Data/Pairing/BN254.hs)
 [BN254A](src/Data/Pairing/BN254A.hs)
 [BN254B](src/Data/Pairing/BN254B.hs)
 [BN254C](src/Data/Pairing/BN254C.hs)
 [BN254D](src/Data/Pairing/BN254D.hs)
 [BN462](src/Data/Pairing/BN462.hs)
A more detailed documentation on their domain parameters can be found in our elliptic curve library.
Disclaimer
This is experimental code meant for researchgrade projects only. Please do not use this code in production until it has matured significantly.
License
Copyright (c) 20182020 Adjoint Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
OR OTHER DEALINGS IN THE SOFTWARE.
*Note that all licence references and agreements mentioned in the pairing README section above
are relevant to that project's source code only.