Antoine Joux has announced a new discrete logarithm record. This time the field is GF( 2^(257*24)). The computation took about “550 CPU hours” (i.e., less than a month on one CPU). As is typical for this new type of algorithm, the majority of the computation was in the descent step, rather than in linear algebra or relation collection.
The relevance for pairing-based cryptography is the following: If one was using supersingular curves (of genus 1 or 2) in characteristic 2 then one would have a group over GF( 2^p ) for some prime (e.g., p = 257) and the pairing would map into an extension of this field of degree 4 or 12. Hence, the target group would be contained in the multiplicative group of GF( 2^(p*24)). Parameters of this size, or even smaller, have been proposed previously in the literature (such as in my “eta pairing” paper with Barreto, O’hEigeartaigh and Scott). The fact that such a large discrete log instance can be solved in a relatively short time has major impact on the security of pairings in small characteristic. The parameters in the eta pairing paper should not be used. It seems prudent now to use pairings only in large prime characteristic for all practical applications.
— Steven Galbraith