What is an embedding degree?

Answer 1

In the context of Algebraic Geometry and Cryptography, the embedding degree is a value associated with an algebraic curve, more precisely with a cyclic subgroup of the abelian group associated with the curve.

Given an elliptic curve (or an hyperelliptic curve), we can consider its associated abelian group - in the case of an elliptic curve corresponds to the set of points - and a cyclic subgroup G, typically its largest.

Using pairings (more notably, the Tate pairing or Weil pairing), we can map G to a subgroup of a finite field.

More precisely, if the curve was defined over a finite field of size q, G is mapped to a subgroup of a finite field of size qk for some integer k. The smallest such integer k is called the embedding degree.

Moreover, if G has size n it satisfies n | qk - 1 (n divides qk - 1).

In Cryptography, the embedding degree most notably appears in security constraints for Elliptic Curve Cryptography and in the more recent area of Pairing Based Cryptography. Pairings allow us to "map" problems over elliptic curves to problems over finite fields and vice-versa with the security and efficiency issues of each side.

For example, given the known attacks for the Discrete Logarithm Problem over elliptic curves and over finite fields, in Elliptic Curve Cryptography curves with a very small embedding degree (lower than 6, say) are usually avoided. On the other hand, because in Pairing Based Cryptography operations are often done on both groups, curves with too high embedding degrees are avoided.