A note on the Ate pairing

Abstract

The Ate pairing has been suggested since it can be computed efficiently on ordinary elliptic curves with small values of the traces of Frobenius t. However, not all pairingfriendly elliptic curves have this property. In this paper, we generalize the Ate pairing and find a series of the variations of the Ate pairing. We show that the shortest Miller loop of the variations of the Ate pairing can possibly be as small as r 1/ϕ(k) on some special pairing-friendly curves with large values of Frobenius trace, and hence speed up the pairing computation significantly.

Faster Pairing Computations on Curves with High-Degree Twists

“…Several papers have proposed methods for loop shortening [30,32,43,42,25]. For example, for the twisted ate pairing one can replace T e by any of its powers modulo r and choose the smallest of those.…”

Faster Pairings on Special Weierstrass Curves

“…There are many other optimizations which speed up the computation of the Miller loop in certain settings, including the denominator elimination technique [4], uses of efficiently computable endomorphisms [24], [15], and loop shortening techniques [2], [16], [3], [20], [26], [19], [25].…”

Computing bilinear pairings on elliptic curves with automorphisms

“…Some extensive surveys of pairing computations can be found in [1,9]. Recently, many results focus on shortening the loop length in Miller's algorithm, e.g., DuursmaLee methods [8], the eta pairing [3], the ate pairing and its variants [14,19,30], as well as the R-ate pairing [17]. In [31], it is proved that all pairings are in a group from an abstract point of view which provides a new explanation for the R-ate pairing.…”