Fp12

Fp12 denotes the finite field with p^12 elements, where p is a prime. It is the degree-12 extension of the prime field F_p and is commonly used as the target field in pairing-based cryptography. In this setting, certain elliptic curve groups map into Fp12 through cryptographic pairings such as the Tate and Weil pairings.

Construction and representation

Fp12 is typically built by forming a tower of extensions starting from F_p. A standard approach is to construct F_p2 = F_p[u]/(u^2 − d) with a non-square d in F_p, then F_p6 = F_p2[v]/(v^3 − e) with a non-square e in F_p2, and finally F_p12 = F_p6[w]/(w^2 − f) with a non-square f in F_p6. This yields a practical representation where elements of Fp12 are polynomials in the new indeterminates with coefficients in the smaller fields. Arithmetic in Fp12 includes addition, multiplication, inversion, and Frobenius endomorphisms, all optimized for efficiency in cryptographic protocols.

Use in cryptography

Because pairing-based constructions require a large enough field to host a subgroup of the elliptic curve order, many pairing-friendly curves use embedding degree k = 12, making Fp12 a natural target field. In schemes based on BN curves and certain BLS12 curves, the final step of the pairing outputs a value in Fp12, after which a final exponentiation places the result in the correct subgroup. The performance of Fp12 arithmetic thus directly impacts the overall efficiency of the protocol.

Examples and relevance

Curves such as BN family and BLS12-381 employ Fp12 as the pairing target field. The choice of p and the field representation influence both speed and security of the cryptographic system.