Barreto-Lynn-Scott (BLS) curves are a stand-out candidate for implementing high-security pairings. This paper shows that particular choices of the pairing-friendly search parameter give rise to four subfamilies of BLS curves, all of which oﬀer highly eﬃcient and implementation friendly pairing instantiations.
Curves from these particular subfamilies are deﬁned over prime ﬁelds that support very eﬃcient towering options for the full extension ﬁeld. The coeﬃcients for a speciﬁc curve and its correct twist are automatically determined without any computational eﬀort. The choice of an extremely sparse search parameter is immediately reﬂected by a highly eﬃcient optimal ate Miller loop and ﬁnal exponentiation. As a resource for implementors, we give a list with examples of implementation-friendly BLS curves through several high-security levels.