Computing bilinear pairings on elliptic curves with automorphisms
ABSTRACT In this paper, we present a novel method for constructing a super-optimal pairing with great efficiency, which we call the
omega pairing. The computation of the omega pairing requires the simple final exponentiation and short loop length in Miller’s
algorithm which leads to a significant improvement over the previously known techniques on certain pairing-friendly curves.
Experimental results show that the omega pairing is about 22% faster and 19% faster than the super-optimal pairing proposed
by Scott at security level of AES 80 bits on certain pairing-friendly curves in affine coordinate systems and projective coordinate
KeywordsElliptic curves–Automorphism–Pairing based cryptography–Weil pairing
- SourceAvailable from: ru.nl[show abstract] [hide abstract]
ABSTRACT: In the rst of two papers on Magma, a new system for computational algebra, we present the Magma language, outline the design principles and theoretical background, and indicate its scope and use. Particular attention is given to the constructors for structures, maps, and sets. c 1997 Academic Press Limited Magma is a new software system for computational algebra, the design of which is based on the twin concepts of algebraic structure and morphism. The design is intended to provide a mathematically rigorous environment for computing with algebraic struc- tures (groups, rings, elds, modules and algebras), geometric structures (varieties, special curves) and combinatorial structures (graphs, designs and codes). The philosophy underlying the design of Magma is based on concepts from Universal Algebra and Category Theory. Key ideas from these two areas provide the basis for a gen- eral scheme for the specication and representation of mathematical structures. The user language includes three important groups of constructors that realize the philosophy in syntactic terms: structure constructors, map constructors and set constructors. The util- ity of Magma as a mathematical tool derives from the combination of its language with an extensive kernel of highly ecient C implementations of the fundamental algorithms for most branches of computational algebra. In this paper we outline the philosophy of the Magma design and show how it may be used to develop an algebraic programming paradigm for language design. In a second paper we will show how our design philoso- phy allows us to realize natural computational \environments" for dierent branches of algebra. An early discussion of the design of Magma may be found in Butler and Cannon (1989, 1990). A terse overview of the language together with a discussion of some of the implementation issues may be found in Bosma et al. (1994).J. Symb. Comput. 01/1997; 24:235-265.
- [show abstract] [hide abstract]
ABSTRACT: We observe a natural generalisation of the ate and twisted ate pairings, which allow for performance improvements in non standard applications of pairings to cryptography like composite group orders. We also give a performance comparison of our pairings and the Tate, ate and twisted ate pairings for certain polynomial families based on operation count estimations and on an implementation, showing that our pairings can achieve a speedup of a factor of up to two over the other pairings.12/2007: pages 302-312;
- [show abstract] [hide abstract]
ABSTRACT: The problem of deducing a function on an algebraic curve having a given divisor is important in the field of indefinite integration. Indeed, it is the main computational step in determining whether an algebraic function posseses an indefinite integral. It has also become important recently in the study of discrete elliptic logarithms in cryptography, and in the construction of the new class of error-correcting codes which exceed the Varshamov-Gilbert bound. It can also be used to give a partial answer to a question raised by Schoof in his paper on computing the exact number of points on an elliptic curve over a finite field.09/2002;
Computing Bilinear Pairings on Elliptic Curves
Chang-An Zhao1, Dongqing Xie1, Fangguo Zhang2,
Jingwei Zhang2and Bing-Long Chen3
1School of Computer Science and Educational Software, Guangzhou University,
Guangzhou 510006, P.R.China
2School of Information Science and Technology, Sun Yat-Sen University,
Guangzhou 510275, P.R.China
3Department of Mathematics, Sun Yat-Sen University, Guangzhou 510275,
Abstract. In this paper, we present a novel method for constructing
a super-optimal pairing with great efficiency, which we call the omega
pairing. The computation of the omega pairing requires the simple final
exponentiation and short loop length in Miller’s algorithm which leads to
a significant improvement over the previously known techniques on cer-
tain pairing-friendly curves. Experimental results show that the omega
pairing is about 22% faster and 19% faster than the super-optimal pair-
ing proposed by Scott at security level of AES 80 bits on certain pairing-
friendly curves in affine coordinate systems and projective coordinate
⋆This work was supported by Guangdong provincial Starting Foundation for Doctors
of China(Grant No. 9451009101003191), the National Natural Science Foundation of
Guangdong Province of China (Grant No. 8151007101000021), the National Natural
Science Foundation of China under Grants No. 10926153 and No. 60773202, and
the National Grand Fundamental Research 973 Program of China under Grant No.
Keywords: Elliptic curves, Automorphism, Pairing based cryptography, Weil
Bilinear pairings play an important role in cryptographic protocols . This
leads to the development of efficient pairing computations since the implemen-
tation of pairing based cryptosystems involves pairing evaluation. In practice,
many methods have been designed for optimizing Miller’s algorithm . Some
extensive surveys of pairing computations can be found in [1,9]. Recently, many
results focus on shortening the loop length in Miller’s algorithm, e.g., Duursma-
Lee methods , the eta pairing , the ate pairing and its variants [14,19,30],
as well as the R-ate pairing . In , it is proved that all pairings are in a
group from an abstract point of view which provides a new explanation for the
R-ate pairing. Vercauteren gives an efficient method to construct the optimal
Ate pairing . Hess presents an integral framework that covers all known fast
pairing functions .
Computing the classical Tate and Weil pairings requires log2r Miller iteration
loops where r is the order of the points. If the number of the Miller iteration loops
is less than log2r/φ(k) where k is the embedding degree of elliptic curves, the cor-
responding pairing is called super-optimal . Motivated by GLV methods ,
Scott indeed constructs a super-optimal pairing on pairing-friendly curves with
embedding degree k = 2 , which is the fastest pairing at security level of
AES 80 bits till now. Using pairing-friendly curves with embedding degree k = 2
has competitive advantages, which is described clearly in . Moreover, pairing
compression techniques can be applied efficiently to reduce the bandwidth in
this case . Therefore, the focus of our presentation is primarily on pairing
computations over pairing-friendly curves with embedding degree k = 2.
In this paper, we present a novel variant of the Weil pairing on ordinary
elliptic curves with nontrivial automorphisms, which we call the omega pairing.
The computation of the omega pairing requires the simple final exponentiation
and short loop length in Miller’s algorithm which leads to a significant improve-
ment over the previous techniques. This new pairing is super-optimal and more
efficient than the previously known pairings on certain pairing-friendly curves.
Experimental results show that the omega pairing is about 22% faster and 19%
faster than the super-optimal pairing proposed by Scott in affine coordinate
systems and projective coordinate systems, respectively.
The rest of this paper is organized as follows. Section 2 introduces the basic
pairings and a family of ordinary elliptic curves with nontrivial automorphisms.
In Section 3, we propose the omega pairing whose structure is similar to that of
the Weil pairing. Section 4 compares the new pairing with the previous fastest
pairing at security level of AES 80 bits on certain pairing-friendly curves and
presents the experimental results.
In this section, we briefly recall the definitions of the Tate and Weil pairings.
Then we introduce a family of elliptic curves with nontrivial automorphisms.
2.1 Tate Pairing
Let Fq be a finite field with q = pmelements where p is a prime, and E an
elliptic curve defined over Fq. Consider a large prime r such that r | #E(Fq),
where #E(Fq) denotes the order of E(Fq). Assume that r2does not divide qk−1
and k is greater than 1, where k is the embedding degree. We denote by E[r]
the r-torsion group of E.
Let DP be a degree zero divisor (see ) which is linearly equivalent to
(P)−(O), where P ∈ E[r] and O is the point at infinity. For every integer i, let
fi,P be a rational function on E with divisor (fi,P) = i(P) − (iP) − (i − 1)(O).
In particular, (fr,P) = rDP. Assume that µr is the r-th roots of unity in Fqk.
Then the reduced Tate pairing  is defined as follows
e : E[r] × E(Fqk) → µr,
e(P,R) = fr,P(R)
Note that fr,P(R)a(qk−1)/r= far,P(R)(qk−1)/rfor any integer a. The ratio-
nal function fr,P can be computed in polynomial time by using Miller’s al-
Using the same notation as before, one can make a few slight modifications and
then define the Weil pairing. Let k be the minimal positive integer such that
E[r] ⊂ E(Fqk). According to the results in , if r ? q − 1 and (r,q) = 1, then
E[r] ⊂ E(Fqk) if and only if r|qk− 1, i.e., the embedding degree for the Weil
pairing is equal to the embedding degree for the Tate pairing in this case.
Suppose that P, Q ∈ E[r] and P ̸= Q. Let DP and DQbe two degree zero
divisors which are linearly equivalent to (P) − (O) and (Q) − (O), respectively.
Suppose that fr,P and fr,Qare two rational functions on E with (fr,P) = rDP
and (fr,Q) = rDQ. Then the Weil pairing is a map 
er: E[r] × E[r] → µr,
er(P,Q) = (−1)rfr,P(Q)
If the embedding degree k is even, one can define the powered Weil pairing [16,
ˆ er(P,Q) = er(P,Q)qk/2−1.
Note that the denominator elimination technique can be used when computing
the powered Weil pairing.
2.3A Family of Elliptic Curves with Nontrivial Automorphisms
Let p be a large prime. Consider the underlying ordinary elliptic curves over Fp
E1: y2=x3+ B,where p ≡ 1 mod 3,
E2: y2=x3+ Ax,where p ≡ 1 mod 4.
Elliptic curves of this form have efficiently computable endomorphisms which
are applied in fast point multiplication  and the computation of the Tate
pairing . In fact, these endomorphisms are also automorphisms which are
used in speeding up the discrete log computation . Note that some pairing-
friendly curves like E1with low embedding degrees have been constructed in [24,
28] and thus can be applied in pairing based cryptosystems. In the following, we
will focus on pairing computations on the elliptic curve like E1. It is clear that
the results can be generalized naturally to the pairing-friendly elliptic curve like
Suppose that β is an element of order three in Fp. An automorphism of E1
is given by
ϕ : E1→ E1,
(x,y) → (βx,y).
Since this automorphism ϕ is also an isogeny, its dual isogeny is given by
ˆϕ : E1→ E1,
(x,y) → (β2x,y).
It is easily seen thatˆϕ◦ϕ = , ϕ2=ˆϕ and #kerϕ = 1 (see Silverman  pages
84-86). Note thatˆϕ is also an automorphism of E1.
We cite useful facts from  for interests. Let P ∈ E1(Fp) be a point of prime
order r, where r2does not divide #E1(Fp). Then ϕ andˆϕ act restrictively on the
subgroup ⟨P⟩ as multiplication maps [λ] and [ˆλ] respectively, i.e., ϕ(P) = λP
andˆϕ(P) =ˆλP, where λ andˆλ are the two roots of the equation: x2+ x + 1 =
0 (mod r). Note that λP = ϕ(P) can be computed using one multiplication in
Assume that the embedding degree of E1 is k = 2. Let E
elliptic curve of E1 with the equation E
quadratic non-residue in Fp. Then E
automorphisms ϕ′andˆϕ′of E
1be the twisted
1:y2= x3+ B/D3, where D is a
1(Fp) has a subgroup ⟨Q′⟩ of order r. Two
1can be given by
(x,y) → (βx,y),(x,y) → (β2x,y).
Suppose that r2does not divide #E′
ϕ′andˆϕ′act restrictively on the subgroup ⟨Q′⟩ as multiplication maps. In prac-
tice, it can be checked that λQ′=ˆϕ′(Q′) andˆλQ′= ϕ′(Q′) using straightforward
1(Fp). By using the same argument as above,
calculations. However, an explanation will be given in the following Lemma 2 of
There exists an isomorphism
ψ : E
(x,y) → (Dx,yD
defined over Fpk. Write Q = ψ(Q′). Then Q is a point in E1(Fpk)[r]. In practical
implementations, Q is specified in this way when the curve only has a quadratic
twist. Since ⟨Q⟩ is isomorphic to ⟨Q′⟩, it leads to λQ =ˆϕ(Q) provided that
λQ′=ˆϕ′(Q′) holds. This observation is instrumental in constructing the new
variants of the Weil pairing.