This page supplements draft-irtf-cfrg-pairing-friendly-curves's Adoption Status section (§4.1) with the full curve-by-curve comparison, including candidates considered and not selected. See Issue #72 for background on this page's scope and venue.
Survey current as of July 2026. Curves selected in the draft (BLS12-381, BN462, BLS48-581) are shown in bold.
Comparison across all curves evaluated during the curve-set discussion (Issue #76), including the proposed alternatives that were not adopted.
| Curve | ISO/IEC 15946-5:2022 | # Libraries | # Applications |
|---|---|---|---|
| BLS12-381 | BLS12 examples added (2022 ed.) | 12+ (blst, mcl, RELIC, MIRACL Core, gnark-crypto, noble-curves, arkworks, constantine, CIRCL, zkcrypto, Adjoint, …) | 6+ (Ethereum, Zcash, Chia, DFINITY, Algorand, Filecoin) |
| BN462 | Annex D.2.3 (exact u-value match) | 3 (mcl, MIRACL Core, Adjoint) | 1 (DFINITY) |
| BLS48-581 | Annex D.3.5 (exact u-value match) | 2 (Kyushu Univ., MIRACL Core) | — |
| BN446 (proposed) | Annex D.2.2 (pre-exTNFS legacy; same ed. sets |p|≥461 guideline) | 1 (RELIC) | — |
| BLS48-575 (proposed) | Not listed | 1 (RELIC) | — |
| BLS24-509 (proposed) | Not listed (ISO 2022 has BLS24 at 559-bit p, not 509) | 0 | — |
The draft groups curves by nominal security level. In this survey, "Arnd" is an
abbreviation for "Around": a curve labelled Arnd 128, Arnd 192
or Arnd 256 has an estimated security level within plus or minus 5 bits of that
level. A label shown with ~ means the estimate falls outside those ranges, between
the level to its left and the level to its right.
The levels below are the post-exTNFS estimates the draft itself states; the draft evaluates security in accordance with [BD18], [GMT19], [MAF19] and [FK18]. Every curve for which the draft states a figure is listed, whether or not it was selected. The band assignments published in the table of draft -12 are superseded by this one.
| Curve | Estimated security level | Band | Status in the draft | Where the draft says so |
|---|---|---|---|---|
| BLS12-381 | approximately 126 bits | Arnd 128 | Selected, on adoption | §4.2.1 (BLS12-381), citing [GMT19] |
| CP8-544 | 131 bits | Arnd 128 | Considered, not selected: implemented in one library | §4.2.2 (BN462), citing [GMT19] |
| BN462 | 134 bits | ~ (above Arnd 128, below Arnd 192) | Selected, on margin | §4.2.2 (BN462), citing [GMT19] |
These three rows are the draft's decision at the 128-bit level. Its policy
prioritises "security" and "widely used" over "efficiency", and
where "widely used" does not separate two candidates it prefers the one with margin
above the nominal level. BN462 sits above the Arnd 128 band and is kept for that
margin. BLS12-381 sits inside the band and slightly below the nominal level, and is the stated
exception, kept because its adoption decisively satisfies "widely used". CP8-544 has
more margin than BLS12-381 and, by its construction, is not affected by further refinements of
the exTNFS attack, and it is faster than BN462; it was not selected because it is implemented
in one library only.
Curves elsewhere on this page are not assigned a band, because the draft does not state a post-exTNFS estimate for them. Curves at or below the 100-bit level, which the draft lists separately, are out of scope for this page.
| Library | Maintainer | Status | Curves ≥ 128-bit (pairing-friendly) |
|---|---|---|---|
| blst | Supranational | Active | BLS12-381 |
| mcl | Herumi (Shigeo Mitsunari) | Active | BLS12-381, BN462, BN254N, BN382M, BN_SNARK1 |
| Kyushu Univ. BLS48 | Kyushu University | Archived (reference impl) | BLS48-581 |
| gnark-crypto | Consensys | Active | BLS12-381, BN254, BLS12-377, BLS24-315, BW6-761, BW6-633 |
| noble-curves | Paul Miller | Active | BLS12-381, BN254 |
| arkworks | arkworks-rs contributors | Active | BLS12-381, BN254, BLS12-377, BLS24-315, BW6-761, MNT4-298, MNT6-298 |
| constantine | Mamy Ratsimbazafy | Active | BLS12-381, BN254, BLS12-377, BW6-761, BLS24-317 |
| CIRCL | Cloudflare | Active | BLS12-381 |
| zkcrypto | zkcrypto contributors | Active | BLS12-381 |
| RELIC | Diego Aranha et al. | Active | BLS12-381, BLS12-446, BLS12-455, BLS12-638, BLS24-477, BLS48-575, BN382R, BN446, BN638, CP8-544, K54-569, KSS18-508, OT8-511 |
| MIRACL Core | MIRACL Ltd. | Active | BLS12-381, BLS48-581, BN462, BLS12-383, BLS12-461, BLS24-479, BLS48-556, BN254N, BN254CX, BN256I, BN512I |
| Adjoint | Adjoint Inc. | Stale | BLS12-381, BN462, BN254N, BN254B, BN254S1, BN254S2, BN_SNARK1 |
| PBC | Stanford University | Legacy | BN (generic), MNT, Freeman, supersingular |
| TEPLA | University of Tsukuba | Legacy | BN254N, BN254B |
| Intel-IPP | Intel | Active | BN256I |
| bls12377js | Celo Foundation | Stale | BLS12-377 |
| Application | Organization | Curve |
|---|---|---|
| Ethereum (consensus / EIP-2537) | Ethereum Foundation | BLS12-381 |
| Zcash (Sapling/Orchard) | Zcash Foundation | BLS12-381 |
| Chia Network | Chia Network Inc. | BLS12-381 |
| DFINITY / Internet Computer | DFINITY Foundation | BLS12-381, BN382M, BN462 |
| Algorand | Algorand Foundation | BLS12-381 |
| Filecoin | Protocol Labs | BLS12-381 (via blst) |
Sources and further detail: notes/table_adoption.md in the repository. A historical 2020-vs-2026 comparison is discussed in Issue #72.