In this report we investigate how to generate secure elliptic curves over sextic extension of prime elds of size roughly 64 bits to achieve 128-bit security. In particular, we present one of such curves over a 64-bit prime eld, which we named Cheetah, and provide its security parameter. This curve is particularly well-suited for zero-knowledge applications such as FRI-based STARK proving systems, as its base prime eld has the property of having a large two-adicity, necessary for FFTrelated

more »

... tions and at the same time it is used for elliptic curve-based signatures. We also provide a prototype implementation of this curve in Rust, featuring constant-time arithmetic and no use of the Rust standard library for WebAssembly support.