Computing bilinear pairings on elliptic curves with automorphisms
ABSTRACT In this paper, we present a novel method for constructing a super-optimal pairing with great efficiency, which we call the
omega pairing. The computation of the omega pairing requires the simple final exponentiation and short loop length in Miller’s
algorithm which leads to a significant improvement over the previously known techniques on certain pairing-friendly curves.
Experimental results show that the omega pairing is about 22% faster and 19% faster than the super-optimal pairing proposed
by Scott at security level of AES 80 bits on certain pairing-friendly curves in affine coordinate systems and projective coordinate
systems, respectively.
KeywordsElliptic curves–Automorphism–Pairing based cryptography–Weil pairing
- [Show abstract] [Hide abstract]
ABSTRACT: 2 DGA sorina.ionica,antoine.joux@m4x.org Abstract. Scott uses an eciently computable isomorphism in order to optimize pairing computation on a particular class of curves with embed- ding degree 2. He points out that pairing implementation becomes thus faster on these curves than on their supersingular equivalent, originally recommended by Boneh and Franklin for Identity Based Encryption. We extend Scott's method to other classes of curves with small embedding degree and eciently computable endomorphism.IACR Cryptology ePrint Archive. 01/2010; 2010:379. -
Conference Paper: Efficient Pairing Computation on Ordinary Elliptic Curves of Embedding Degree 1 and 2.
[Show abstract] [Hide abstract]
ABSTRACT: In pairing-based cryptography, most researches are focused on elliptic curves of embedding degrees greater than six, but less on curves of small embedding degrees, although they are important for pairing-based cryptography over composite-order groups. This paper analyzes efficient pairings on ordinary elliptic curves of embedding degree 1 and 2 from the point of shortening Miller's loop. We first show that pairing lattices presented by Hess can be redefined on composite-order groups. Then we give a simpler variant of the Weil pairing lattice which can also be regarded as an Omega pairing lattice, and extend it to ordinary curves of embedding degree 1. In our analysis, the optimal Omega pairing, as the super-optimal pairing on elliptic curves of embedding degree 1 and 2, could be more efficient than Weil and Tate pairings. On the other hand, elliptic curves of embedding degree 2 are also very useful for pairings on elliptic curves over RSA rings proposed by Galbraith and McKee. So we analyze the construction of such curves over RSA rings, and redefine pairing lattices over RSA rings. Specially, modified Omega pairing lattices over RSA rings can be computed without knowing the RSA trapdoor. Furthermore, for keeping the trapdoor secret, we develop an original idea of evaluating pairings without leaking the group order.Cryptography and Coding - 13th IMA International Conference, IMACC 2011, Oxford, UK, December 12-15, 2011. Proceedings; 01/2011
Page 1
Computing Bilinear Pairings on Elliptic Curves
with Automorphisms⋆
Chang-An Zhao1, Dongqing Xie1, Fangguo Zhang2,
Jingwei Zhang2and Bing-Long Chen3
1School of Computer Science and Educational Software, Guangzhou University,
Guangzhou 510006, P.R.China
2School of Information Science and Technology, Sun Yat-Sen University,
Guangzhou 510275, P.R.China
3Department of Mathematics, Sun Yat-Sen University, Guangzhou 510275,
P.R.China.
changanzhao@gmail.com
dqxie@hnu.cn
isszhfg@mail.sysu.edu.cn
zhangjw3@mail2.sysu.edu.cn
mcscbl@mail.sysu.edu.cn
Abstract. In this paper, we present a novel method for constructing
a super-optimal pairing with great efficiency, which we call the omega
pairing. The computation of the omega pairing requires the simple final
exponentiation and short loop length in Miller’s algorithm which leads to
a significant improvement over the previously known techniques on cer-
tain pairing-friendly curves. Experimental results show that the omega
pairing is about 22% faster and 19% faster than the super-optimal pair-
ing proposed by Scott at security level of AES 80 bits on certain pairing-
friendly curves in affine coordinate systems and projective coordinate
systems, respectively.
⋆This work was supported by Guangdong provincial Starting Foundation for Doctors
of China(Grant No. 9451009101003191), the National Natural Science Foundation of
Guangdong Province of China (Grant No. 8151007101000021), the National Natural
Science Foundation of China under Grants No. 10926153 and No. 60773202, and
the National Grand Fundamental Research 973 Program of China under Grant No.
2006CB303104.
Page 2
2
Keywords: Elliptic curves, Automorphism, Pairing based cryptography, Weil
pairing
1Introduction
Bilinear pairings play an important role in cryptographic protocols [22]. This
leads to the development of efficient pairing computations since the implemen-
tation of pairing based cryptosystems involves pairing evaluation. In practice,
many methods have been designed for optimizing Miller’s algorithm [20]. Some
extensive surveys of pairing computations can be found in [1,9]. Recently, many
results focus on shortening the loop length in Miller’s algorithm, e.g., Duursma-
Lee methods [8], the eta pairing [3], the ate pairing and its variants [14,19,30],
as well as the R-ate pairing [17]. In [31], it is proved that all pairings are in a
group from an abstract point of view which provides a new explanation for the
R-ate pairing. Vercauteren gives an efficient method to construct the optimal
Ate pairing [29]. Hess presents an integral framework that covers all known fast
pairing functions [13].
Computing the classical Tate and Weil pairings requires log2r Miller iteration
loops where r is the order of the points. If the number of the Miller iteration loops
is less than log2r/φ(k) where k is the embedding degree of elliptic curves, the cor-
responding pairing is called super-optimal [29]. Motivated by GLV methods [11],
Scott indeed constructs a super-optimal pairing on pairing-friendly curves with
embedding degree k = 2 [24], which is the fastest pairing at security level of
AES 80 bits till now. Using pairing-friendly curves with embedding degree k = 2
has competitive advantages, which is described clearly in [25]. Moreover, pairing
compression techniques can be applied efficiently to reduce the bandwidth in
this case [10]. Therefore, the focus of our presentation is primarily on pairing
computations over pairing-friendly curves with embedding degree k = 2.
In this paper, we present a novel variant of the Weil pairing on ordinary
elliptic curves with nontrivial automorphisms, which we call the omega pairing.
The computation of the omega pairing requires the simple final exponentiation
and short loop length in Miller’s algorithm which leads to a significant improve-
ment over the previous techniques. This new pairing is super-optimal and more
efficient than the previously known pairings on certain pairing-friendly curves.
Experimental results show that the omega pairing is about 22% faster and 19%
Page 3
3
faster than the super-optimal pairing proposed by Scott in affine coordinate
systems and projective coordinate systems, respectively.
The rest of this paper is organized as follows. Section 2 introduces the basic
pairings and a family of ordinary elliptic curves with nontrivial automorphisms.
In Section 3, we propose the omega pairing whose structure is similar to that of
the Weil pairing. Section 4 compares the new pairing with the previous fastest
pairing at security level of AES 80 bits on certain pairing-friendly curves and
presents the experimental results.
2Preliminaries
In this section, we briefly recall the definitions of the Tate and Weil pairings.
Then we introduce a family of elliptic curves with nontrivial automorphisms.
2.1Tate Pairing
Let Fq be a finite field with q = pmelements where p is a prime, and E an
elliptic curve defined over Fq. Consider a large prime r such that r | #E(Fq),
where #E(Fq) denotes the order of E(Fq). Assume that r2does not divide qk−1
and k is greater than 1, where k is the embedding degree. We denote by E[r]
the r-torsion group of E.
Let DP be a degree zero divisor (see [27]) which is linearly equivalent to
(P)−(O), where P ∈ E[r] and O is the point at infinity. For every integer i, let
fi,P be a rational function on E with divisor (fi,P) = i(P) − (iP) − (i − 1)(O).
In particular, (fr,P) = rDP. Assume that µr is the r-th roots of unity in Fqk.
Then the reduced Tate pairing [4] is defined as follows
e : E[r] × E(Fqk) → µr,
e(P,R) = fr,P(R)
qk−1
r .
Note that fr,P(R)a(qk−1)/r= far,P(R)(qk−1)/rfor any integer a. The ratio-
nal function fr,P can be computed in polynomial time by using Miller’s al-
gorithm [20,21].
2.2Weil Pairing
Using the same notation as before, one can make a few slight modifications and
then define the Weil pairing. Let k be the minimal positive integer such that
Page 4
4
E[r] ⊂ E(Fqk). According to the results in [2], if r ? q − 1 and (r,q) = 1, then
E[r] ⊂ E(Fqk) if and only if r|qk− 1, i.e., the embedding degree for the Weil
pairing is equal to the embedding degree for the Tate pairing in this case.
Suppose that P, Q ∈ E[r] and P ̸= Q. Let DP and DQbe two degree zero
divisors which are linearly equivalent to (P) − (O) and (Q) − (O), respectively.
Suppose that fr,P and fr,Qare two rational functions on E with (fr,P) = rDP
and (fr,Q) = rDQ. Then the Weil pairing is a map [21]
er: E[r] × E[r] → µr,
er(P,Q) = (−1)rfr,P(Q)
fr,Q(P).
If the embedding degree k is even, one can define the powered Weil pairing [16,
18] as
ˆ er(P,Q) = er(P,Q)qk/2−1.
Note that the denominator elimination technique can be used when computing
the powered Weil pairing.
2.3A Family of Elliptic Curves with Nontrivial Automorphisms
Let p be a large prime. Consider the underlying ordinary elliptic curves over Fp
E1: y2=x3+ B,where p ≡ 1 mod 3,
E2: y2=x3+ Ax,where p ≡ 1 mod 4.
Elliptic curves of this form have efficiently computable endomorphisms which
are applied in fast point multiplication [11] and the computation of the Tate
pairing [24]. In fact, these endomorphisms are also automorphisms which are
used in speeding up the discrete log computation [7]. Note that some pairing-
friendly curves like E1with low embedding degrees have been constructed in [24,
28] and thus can be applied in pairing based cryptosystems. In the following, we
will focus on pairing computations on the elliptic curve like E1. It is clear that
the results can be generalized naturally to the pairing-friendly elliptic curve like
E2.
Suppose that β is an element of order three in Fp. An automorphism of E1
is given by
ϕ : E1→ E1,
(x,y) → (βx,y).
Page 5
5
Since this automorphism ϕ is also an isogeny, its dual isogeny is given by
ˆϕ : E1→ E1,
(x,y) → (β2x,y).
It is easily seen thatˆϕ◦ϕ = [1], ϕ2=ˆϕ and #kerϕ = 1 (see Silverman [27] pages
84-86). Note thatˆϕ is also an automorphism of E1.
We cite useful facts from [11] for interests. Let P ∈ E1(Fp) be a point of prime
order r, where r2does not divide #E1(Fp). Then ϕ andˆϕ act restrictively on the
subgroup ⟨P⟩ as multiplication maps [λ] and [ˆλ] respectively, i.e., ϕ(P) = λP
andˆϕ(P) =ˆλP, where λ andˆλ are the two roots of the equation: x2+ x + 1 =
0 (mod r). Note that λP = ϕ(P) can be computed using one multiplication in
Fp.
Assume that the embedding degree of E1 is k = 2. Let E
elliptic curve of E1 with the equation E
quadratic non-residue in Fp. Then E
automorphisms ϕ′andˆϕ′of E
′
1be the twisted
′
1:y2= x3+ B/D3, where D is a
′
1(Fp) has a subgroup ⟨Q′⟩ of order r. Two
1can be given by
′
ϕ′: E
′
1→ E
′
1,
ˆϕ′: E
′
1→ E
′
1,
(x,y) → (βx,y),(x,y) → (β2x,y).
Suppose that r2does not divide #E′
ϕ′andˆϕ′act restrictively on the subgroup ⟨Q′⟩ as multiplication maps. In prac-
tice, it can be checked that λQ′=ˆϕ′(Q′) andˆλQ′= ϕ′(Q′) using straightforward
1(Fp). By using the same argument as above,
calculations. However, an explanation will be given in the following Lemma 2 of
Section 3.
There exists an isomorphism
ψ : E
′
1→ E1,
(x,y) → (Dx,yD
3
2)
defined over Fpk. Write Q = ψ(Q′). Then Q is a point in E1(Fpk)[r]. In practical
implementations, Q is specified in this way when the curve only has a quadratic
twist. Since ⟨Q⟩ is isomorphic to ⟨Q′⟩, it leads to λQ =ˆϕ(Q) provided that
λQ′=ˆϕ′(Q′) holds. This observation is instrumental in constructing the new
variants of the Weil pairing.
Page 6
6
3 New Variants of The Weil Pairing
In this section, we will construct the new variants of the Weil pairing. For inter-
ests, we will focus on pairing-friendly curves with the embedding degree k = 2
which has competitive merits in the implementations. It is not difficult to see
that our results can be generalized to pairing-friendly curve like E1and E2with
even embedding degree.
Let p be a prime such that p ≡ 1 (mod 3), and E1an ordinary elliptic curve
over Fpwith equation: E1: y2= x3+ B. Consider a large prime r such that
r | #E1(Fp). Assume that E1 has the embedding degree k = 2 with respect
to r. The quadratic twist E′
where D is a quadratic non-residue in Fp. Suppose that r2? #E1(Fp) and r2?
#E
′
1→ E1,(x,y) → (Dx,D
order three in Fp. Two automorphisms ϕ andˆϕ of E1are given by ϕ : E1→ E1,
(x,y) → (βx,y) andˆϕ : E1→ E1, (x,y) → (β2x,y), respectively. Assume that
λ is a root of the equation x2+ x + 1 = 0 (mod r) such that λP = ϕ(P) and
λQ =ˆϕ(Q). Let a be the integer such that ar = λ2+ λ + 1. Then we have the
1is given by the equation E′
1: y2= x3+ B/D3,
′
1(Fp). Let P ∈ E1(Fp)[r] and Q′∈ E′
ψ : E
1(Fp)[r]. An isomorphism is given by
2y). Write Q = ψ(Q′). Let β be an element of
3
following results.
Theorem 1. For the points P and Q in E1[r] given in the above, the function
ω(P,Q) = (fλ,P(Q)
fλ,Q(P))p−1defines a bilinear pairing.
We will show that ω(P,Q) equals a fixed power of the Weil pairing. This new
pairing is named as the omega pairing. The non-degeneracy of ω(P,Q) holds if
ˆ er(P,Q) is non-degenerate and r does not divide a. The proof of Theorem 1 is
based on the following useful lemmas.
Lemma 1. There does not exist an integer m such that ϕ(S) = mS for all
S ∈ E1[r].
Proof. It is known that E1[r]∼= Zr×Zrcan be viewed as a two-dimensional vec-
tor space. We remark that ϕ : E1[r] → E1[r] is a linear map, whose characteristic
polynomial is g(x) = x2+ x + 1 [23]. It suffices to show that the characteris-
tic polynomial g(x) has no multiple roots. If not, assume that m is an integer
such that ϕ(S) = mS for every point S ∈ E1[r], then m is a multiple root of
x2+ x + 1 = 0 (mod r). It follows from ϕ(P) ̸= P that m ̸= 1. Note that the
Page 7
7
derivative of the characteristic polynomial g(x) is 2x+1. So m must satisfy the
following equation
{
x2+ x + 1 = 0(mod r)
2x + 1 = 0 (mod r)
It is obvious that there does not exist such an integer m satisfying the above
equation if r = 2. Thus we may assume that r ̸= 2. Then we conclude that only
r = 3 and m = 1 satisfy the conditions. However, m can not be equal to 1. So we
can not find an integer m such that ϕ(S) = mS for all S ∈ E1[r]. This completes
the proof of Lemma 1.
⊓ ⊔
Lemma 2. Using the notation defined as above, we have λQ =ˆϕ(Q).
Proof. The isomorphism
ψ : E
′
1→ E1,
(x,y) → (Dx,D
3
2y)
maps Q′∈ E
Then we see that
′
1(Fp)[r] into E1(Fpk)[r]. It follows that ⟨Q⟩ is isomorphic to ⟨Q′⟩.
λQ = λ(ψ(Q′)) = ψ(λQ′).
Note that λQ′must equalˆϕ′(Q′) or ϕ′(Q′), whereˆϕ′and ϕ′are denoted in the
previous Section 2.3. In the following, we will show that λQ′=ˆϕ′(Q′) which
leads to λQ =ˆϕ(Q).
Write Q′= (xQ′,yQ′). Then Q = ψ(Q′) = (DxQ′,D
we deduce
3
2yQ′). If λQ′= ϕ′(Q′),
λQ = λ(ψ(Q′)) = ψ(λQ′) = ψ(ϕ′(Q′)) = (βDxQ′,D
3
2yQ′) = ϕ(Q).
Note that E1[r] = {P ∈ E1(Fp)|rP = O} can be viewed as a two-dimensional
vector space. It is not hard to see that {P,Q} is a basis for E1[r]. According to
ϕ(P) = λP and ϕ(Q) = λQ, it is immediate that ϕ(S) = λS for every point
S ∈ E1[r], a contradiction to Lemma 1. Therefore, we have λQ′=ˆϕ′(Q′). It
follows that
λQ = λ(ψ(Q′)) = ψ(λQ′) = ψ(ˆϕ′(Q′)) = (β2DxQ′,D
3
2yQ′) =ˆϕ(Q).
This completes the proof of Lemma 2.
⊓ ⊔
Page 8
8
Lemma 3. For i ∈ Z, the function F(P,Q) =
fi,P(iQ)
fi,Q(iP)satisfies
(fi,P(iQ)
fi,Q(iP))p−1= (fi,P(Q)
fi,Q(P))i(p−1).
Proof. To prove the assertion, it suffices to show that
(fi,P(iQ)fi,P(Q)−i)p−1= (fi,Q(iP)fi,Q(P)−i)p−1.
Let t be a Fp-rational local parameter for O. Assume that (t)∩P = ∅. Thus the
Fp-rational divisor (i − 1)(O) + (
Since fi,Pis a Fp-rational function, it follows that fi,P((i−1)(O)+(
by Fermat’s Little Theorem (or Lemma 1 in [8]). Then
1
ti−1) satisfies (i − 1)(O) + (
1
ti−1) ∩ (fi,P) = ∅.
1
ti−1))p−1= 1
(fi,P(iQ)fi,P(Q)−i)p−1=(fi,P(iQ)fi,P(Q)−ifi,P((i − 1)(O) + (
1
ti−1)))p−1
1
ti−1))p−1
=fi,P(−(i(Q) − (iQ) − (i − 1)(O)) + (
1
fi,Qti−1))p−1.
=fi,P((
Note that (fi,P) ∩ (
fi,P((
1
fi,Qti−1) = ∅. Thanks to Weil reciprocity [9,21], we have
fi,Qti−1)) = fi,Qti−1((fi,P))−1and thus
1
(fi,P(iQ)fi,P(Q)−i)p−1=(fi,Qti−1((fi,P))−1)p−1
=(fi,Qti−1(i(P) − (iP) − (i − 1)(O))−1)p−1.
By Theorem 1 in [4] and Theorem 2 in [8], we can discard the evaluation of the
rational function at the infinity point. Thus
(fi,P(iQ)fi,P(Q)−i)p−1=(fi,Qti−1((fi,P))−1)p−1
=(fi,Qti−1(i(P) − (iP))−1)p−1
=(fi,Qti−1(iP)fi,Qti−1(P)−i)p−1
=(fi,Q(iP)fi,Q(P)−i)p−1.
The last identity holds since ti−1(iP)p−1= 1 and ti−1(P)p−1= 1 using Fermat’s
Little Theorem. This completes the proof of Lemma 3.
⊓ ⊔
Corollary 1. If i = λ with λ defined as above, we have
(fλ,P(λQ)
fλ,Q(λP))p−1= (fλ,P(Q)
fλ,Q(P))λ(p−1).
Page 9
9
Note that Corollary 1 is instrumental in the construction of the omega pair-
ing. In light of the above discussion, one arrives then at the following proof of
Theorem 1.
Proof (of Theorem 1). According to the results in [29], we have
far,P(Q) = fλ,P(Q)λ+1· fλ,P(ˆϕ(Q)) · lϕ(P),ˆϕ(P)(Q).
By using the same argument for far,Q(P), we obtain
far,Q(P) = fλ,Q(P)λ+1· fλ,Q(ϕ(P)) · lϕ(Q),ˆϕ(Q)(P).
It is not hard to see that lϕ(Q),ˆϕ(Q)(P) = −(lϕ(P),ˆϕ(P)(Q)). Altogether,
ˆ er(P,Q)a=(far,P(Q)
far,Q(P))qd−1
fλ,P(Q)λ+1· fλ,P(ˆϕ(Q)) · lϕ(P),ˆϕ(P)(Q)
fλ,Q(P)λ+1· fλ,Q(ϕ(P)) · lϕ(Q),ˆϕ(Q)(P))p−1
=((fλ,P(Q)
fλ,Q(ϕ(P)))p−1.
=(
fλ,Q(P))λ+1·fλ,P(ˆϕ(Q))
Sinceˆϕ(Q) = λQ and ϕ(P) = λP, we obtain
ˆ er(P,Q)a= ((fλ,P(Q)
fλ,Q(P))λ+1·fλ,P(ˆϕ(Q))
fλ,Q(ϕ(P)))p−1= ((fλ,P(Q)
fλ,Q(P))λ+1·fλ,P(λQ)
fλ,Q(λP))p−1.
By Corollary 1, we have
ˆ er(P,Q)a= (fλ,P(Q)
fλ,Q(P))(2λ+1)(p−1).
Let M ≡ (2λ + 1)−1(mod r). Since a fixed power of the pairing keeps bilinear-
ity [31], it follows that
ω(P,Q) = ˆ er(P,Q)aM= (fλ,P(Q)
fλ,Q(P))p−1
does define a new pairing. This completes the proof of Theorem 1.
⊓ ⊔
Using the similar analysis, the omega pairing can be generalized on the elliptic
curve like E2. Let p be a prime such that p ≡ 1 (mod 4), and E2an ordinary
elliptic curve over Fpwith equation: E2: y2= x3+ Ax. Consider a large prime
r such that r | #E2(Fp). Assume that E2has the the embedding degree k = 2
Page 10
10
with respect to r. The quadratic twist E′
x3+A/D2x, where D is a quadratic non-residue in Fp. Suppose that r2? #E2(Fp)
and r2? #E
given by ψ : E
2→ E2,(x,y) → (Dx,D
α be an element of order four in Fp. Two automorphisms ϕ andˆϕ of E2 are
given by ϕ : E2→ E2,(x,y) → (−x,αy) andˆϕ : E2→ E2,(x,y) → (−x,−αy)
respectively. Let λ be the root of the equation x2+ 1 = 0 (mod r) such that
λP = ϕ(P) and λQ =ˆϕ(Q). Then we have the following results.
2is given by the equation E′
2: y2=
′
2(Fp). Let P ∈ E2(Fp)[r] and Q′∈ E′
′
2(Fp)[r]. An isomorphism is
2y). Write Q = ψ(Q′). Assume that
3
Theorem 2. For the points P and Q in E2[r] in the above, the function ω(P,Q) =
(fλ,P(Q)
fλ,Q(P))p−1defines a bilinear pairing.
Proof. This follows immediately from the proof of Theorem 1.
⊓ ⊔
The number of the Miller iteration loops for computing the omega pairing
is determined by the bit length of λ, which is possibly half that of r. Note that
computing the omega pairing requires the simple final exponentiation. These lead
to a significant improvement over the previous techniques. By Theorem 1 and 2,
we establish a modified Miller’s algorithm for computing the omega pairing in
Algorithm 1.
We give some useful remarks which have been discussed in [12,25] in the
implementations. Write Fp2 = Fp(i) with i ∈ Fp2 \Fpand i2∈ Fp. Let ν = a+bi
with a, b ∈ Fp. Then the conjugate of ν can be given by ν = a + bi = a − bi.
Note that
fλ,Q(P)can be replaced by its conjugate fλ,Q(P) according to the
observations in [26]. A second useful remark is that one can share the same Miller
fλ,P(Q)
fλ,Q(P). Finally, we can employ Montgomery’s trick
to compute scalar multiplications of P and Q′in affine coordinate systems.
1
variable f when computing
4Efficiency Comparison
Now the performance of the proposed algorithm is considered in this section.
We neglect the cost of field additions and subtractions, as well as the cost of
multiplication by small constants. The computation cost of one multiplication
and one inverse in Fpcan be denoted as M and I, respectively. We also count
one square as one multiplication in Fp. If i2∈ Fpis very small, one square and
one multiplication in Fp2 is equal to 2M and 3M respectively. We will implement
pairing computations on the pairing-friendly curve with embedding degree k = 2
Page 11
11
Algorithm 1 Computation of ω(P,Q)
Input: λ =∑n
Output: ω(P,Q)
1. T ← P, T′← Q′, f ← 1,
2. for i = n − 1,n − 2,··· ,1,0 do
2.1 f ← f2· lT,T(Q) · lψ(T′),ψ(T′)(P), T ← 2T, T′← 2T′
2.2 if li = 1 then
2.3 f ← f · lT,P(Q) · lψ(T′),ψ(Q′)(P), T ← T + P, T′← T′+ Q′
3. return fp−1
i=0li2i, where li ∈ {0,1}. P ∈ E1(Fp)[r] and Q′∈ E′
1(Fp)[r]. Q =
ψ(Q′).
given by Scott in [24]. Note that we can choose the suitable λ which has low
Hamming weight on this family of pairing-friendly curves [24,28].
If affine coordinates are employed, one point doubling requires 1I +4M and
one point addition requires 1I +3M in E(Fp) respectively [15]. We first consider
the cost of Line 2.1 in Algorithm 2. Computing directly 2T and 2T′requires 2I+
8M. However, due to Montgomery’s trick, computing the two point doublings
reduces to 1I + 11M. Two line evaluations require 2M. The remainder of Line
2.1 requires 1S2+ 2M2= 2M + 6M = 8M for computing one square and two
multiplications in Fp2. Thus Line 2.1 in one iteration loop needs 21M +1I. Since
λ = 280+ 216in [24], the total contribution from Line 2.1 is (21M + 1I) · 80 =
1680M + 80I. It is not difficult to show that the total contribution from Line
2.3 is 1I + 17M. By now, we cost (1680M + 17M) + 81I = 1697M + 81I.
The exponentiation (p − 1) requires 5M + 1I since the Frobenius map can be
used here. Thus the total cost for Algorithm 2 in affine coordinate systems is
1702M + 82I.
If Jacobian projective coordinates are employed, one point doubling requires
8M and one point addition requires 11M in E(Fp) respectively [15]. Computing
lT,T(Q) requires 4M provided that the operation T ← 2T has been computed [6].
We can see that the cost of computing 2T′and lψ(T′),ψ(T′)(P)) is 12M in a similar
way. Also, computing f2· lT,T(Q) · lψ(T′),ψ(T′)(P) requires 8M. Thus the cost
of Line 2.1 is 24M + 8M = 32M. In the whole iteration, we need 80 · 32M =
2560M for the part of point doubling and line evaluation. the total cost of point
addition and line evaluation requires 34M. Thus the total cost for Algorithm 2
in projective coordinate systems is 2560M + 34M + 5M + 1I = 2599M + 1I.
Page 12
12
Using the similar analysis, the cost for Algorithm 4 in [24] can be also given
in different coordinate systems. The cost of computing the omega pairing and
the proposed pairing in [24] is summarized in Table 1. We implement the com-
putation of the omega pairing and the previous fastest pairing using Magma
online demo [5]. Experimental results indicate that the omega pairing is about
22% faster and 19% faster than the previous fastest pairing in affine coordinate
systems and projective coordinate systems, respectively.
Table 1. Efficiency Comparison of the Computations of the Different Pairings
PairingsOperation1I = 30M 1I = 10M Time
AffineProposed pairing in [24] 2162M + 82I 4622M2982M7.2ms
ω(P,Q)1702M + 82I 4162M2522M 5.9ms
Projective Proposed pairing in [24] 2817M + 1I2847M2827M 7.9ms
ω(P,Q)2599M + 1I2629M2609M 6.6ms
Acknowledgements
We would like to thank the referee for his helpful suggestions. We also thank
Steven Galbraith, Mike Scott, and Chaoping Xing for their comments on an
early draft of this manuscript.
References
1. R. Avanzi, H. Cohen, C. Doche, G. Frey, T. Lange, K. Nguyen, and F. Vercauteren.
Handbook of Elliptic and Hyperelliptic Curve Cryptography, Discrete Mathematics
and its Applications (Boca Raton). Chapman & Hall/CRC, Boca Raton, FL (2006)
2. R. Balasubramanian and N. Koblitz. The improbability that an elliptic curve has
sub-exponential discrete log problem under the Menezes-Okamoto-Vanstone algo-
rithm, J. Cryptology, vol. 11, no. 2, pp. 141-145. (1998)
3. P.S.L.M. Barreto, S. Galbraith, C.´Oh´Eigeartaigh, and M. Scott. Efficient pairing
computation on supersingular Abelian varieties, Designs, Codes and Cryptography,
vol. 42, no. 3, pp. 239-271. Springer-Netherlands (2007)
Page 13
13
4. P.S.L.M. Barreto, H.Y. Kim, B. Lynn, and M. Scott. Efficient algorithms for pairing-
based cryptosystems, in Proc. Advances in Cryptology-Crypto 2002, Lecture Notes
in Computer Science, vol. 2442, pp. 354-368, Springer-Verlag (2002)
5. W.Bosma,J. Cannon,andC.Playoust,The Magmaalgebra system.
I. The user language,” J. Symbolic Comput., vol. 24 no. 3,pp. 235-265,
http://magma.maths.usyd.edu.au/ (1997)
6. S. Chatterjee, P. Sarkar, and R. Barua, Efficient Computation of Tate Pairingin Pro-
jective Coordinate over General Characteristic Fields, minus in ICISC 2004, Lecture
Notes in Computer Science, vol. 3506, pp. 168C181, Springer-Verlag (2005)
7. I. Duursma, P. Gaudry, and F. Morain. Speeding up the discrete log computation on
curves with automorphisms, in Proc. Advances in Cryptology-AsiaCrypt 99, Lecture
Notes in Computer Science, vol. 1716, pp. 203-121, Springer-Verlag (1999)
8. I. Duursma, H.-S. Lee. Tate pairing implementation for hyperelliptic curves y2=
xp− x + d, in Advances in Cryptology-AsiaCrypt’2003, Lecture Notes in Computer
Science, vol. 2894, pp. 111-123, Springer-Verlag (2003)
9. S. Galbraith. Pairings, Ch. IX of I.F. Blake, G. Seroussi, and N.P. Smart, eds.,
Advances in Elliptic Curve Cryptography. Cambridge University Press (2005)
10. S. Galbraith and X. Lin. Computing pairings using x-coordinates only, Designs,
Codes and Cryptography. vol. 50, no. 3, pp. 305-324. Springer-Netherlands (2009)
11. R.P. Gallant, R.J. Lambert and S.A. Vanstone. Faster point multiplication on
elliptic curves with efficient endomorphisms, in Proc. Advances in Cryptology-Crypto
2001, Lecture Notes in Computer Science, vol. 2139, pp. 190-200, Springer-Verlag
(2001)
12. R. Granger and N.P. Smart. On computing products of pairings. Technical Report
CSTR-06-013, University of Bristol (2006)
13. F. Hess. Pairing lattices. in Pairing 2008, Lecture Notes in Computer Science, vol.
5209, pp. 18-38, Springer-Verlag (2008)
14. F. Hess, N.P. Smart and F. Vercauteren. The Eta pairing revisited, IEEE Trans.
Inform. Theory, vol. 52, no. 10, pp. 4595-4602 (2006)
15. IEEE Std 1363-2000. Standard Specifications for Public-key Cryptography. IEEE
P1363 Working Group (2000)
16. B. G. Kang and J. H. Park. On the relationship between squared pairings and
plain pairings, Inf. Process. Lett. vol. 97, no. 6, pp. 219-224 (2006)
17. E. Lee, H.-S. Lee, and C.-M. Park. Efficient and generalized pairing computation
on Abelian varieties, IEEE Trans. Inform. Theory, vol. 55, no.4, pp. 1793-1803 (2009)
18. A.J. Menezes and N. Koblitz. Pairing-based cryptography at high security levels, in
Cryptography and Coding, Lecture Notes in Computer Science, vol. 3796, pp. 13-36,
Springer-Verlag (2005)
Page 14
14
19. S. Matsuda, N. Kanayama, F. Hess, and E. Okamoto. Optimised versions of the Ate
and twisted Ate pairings, in Cryptography and Coding, Lecture Notes in Computer
Science, vol. 4887, pp. 302-312, Springer-Verlag (2007)
20. V.S. Miller. Short programs for functions on curves, [online]. Available from
http://crypto.stanford.edu/miller/miller.pdf
21. V.S. Miller. The Weil pairing and its efficient calculation, J. Cryptology, vol. 17,
no. 44, pp. 235-261 (2004)
22. K.G. Paterson. Cryptography from Pairing, Ch. X of I.F.Blake, G.Seroussi, and
N.P.Smart, eds., Advances in Elliptic Curve Cryptography. Cambridge University
Press (2005)
23. P. R. Schoof. Counting points on elliptic curves over finite fields. Journal de Th´ eorie
des Nombres de Bordeaux 7, pp. 219-254 (1995)
24. M. Scott. Faster pairings using an elliptic curve with an efficient endomorphism, in
Progress in Cryptology - IndoCrypt 2005, Lecture Notes in Computer Science, vol.
3797, pp. 258-269, Springer-Verlag (2005)
25. M. Scott. Computing the Tate pairing, in CT-RSA’05, Lecture Notes in Computer
Science, vol. 3376, pp. 293-304, Springer-Verlag. (2005)
26. M. Scott. Implementing cryptographic pairings, in Pairing 2007, Lecture Notes in
Computer Science, vol. 4575, pp. 177-196, Springer-Verlag (2007)
27. J.H. Silverman. The Arithmetic of Elliptic Curves. New York, Springer-Verlag
(1986)
28. K. Takashima. Scaling security of elliptic curves with fast pairing using efficient
endomorphisms, IEICE Trans. Fundamentals, vol E90-A, no. 1, pp. 152-159, 2007.
29. F. Vercauteren. Optimal pairings,IEEE Trans. Inform. Theory, vol. 56, no.1, pp.
455-461 (2009)
30. C.-A. Zhao, F. Zhang and J. Huang. A note on the Ate pairing, Int. J. Inf. Security,
vol. 7, no. 6, pp. 379-382, (2008)
31. C.-A. Zhao, F. Zhang and J. Huang. All pairings are in a group, IEICE Trans.
Fundamentals, vol E91-A, no.10, pp. 3084-3087 (2008)