Ate Pairing on Hyperelliptic Curves

Abstract

Abstract. In this paper we show that the Ate pairing, originally defined for elliptic curves, generalises to hyperelliptic curves and in fact to arbitrary algebraic curves. It has the following surprising properties: The loop length in Miller's algorithm can be up to g times shorter than for the Tate pairing, with g the genus of the curve, and the pairing is automatically reduced, i.e. no final exponentiation is needed.

A generalisation of Miller's algorithm and applications to pairing computations on abelian varieties

“…However, working directly on the curve has the drawback that twists of curves are not easy to relate explicitly to twists of the Jacobian, hence it is hard to generalize the twisted ate pairing in higher genus [12]. Since our point of view is to consider pairing on abelian varieties, it is easy for us to extend all results of [14] to higher dimension.…”

“…It is well known (see for instance [12]) that in the case that (0) is in the pole of the function f ,n,P then the Tate pairing can be defined as f ,n,P (Q)/c where c correspond to the leading coefficient of f ,n,P in the completion of Θ n along A . Equation (27) can be seen as a version of this since the leading coefficient of f ,n,P,i is the same as f ,n,P,j and the latter can be obtained as θj ( z P ) θj (0) (up to a th -power) when (0) is not in the pole of Θ n,j .…”

“…For a curve defined over a finite field, using the absolute Frobenius endomorphism, this last line of ideas has led to the definition of eta-pairings [2], ate-pairings [14,12] and optimal pairings [28]. The paper [20] describes a new algorithm based on the theory of theta functions to compute Weil and Tate pairings which apply to all abelian varieties.…”

Efficient Pairing Computation on Genus 2 Curves in Projective Coordinates

“…One can show that if the function f n,D1 is properly normalized, we only need to evaluate the rational function f n,D1 at the effective part of the reduced divisor D 2 in order to compute the Tate pairing [3,14].…”

“…considered the Eta pairing computation on general divisors on supersingular genus 3 hyperelliptic curves with the form of y 2 = x 7 − x ± 1. Recently, the Ate pairing, which is an extension of the Eta pairing to the setting of ordinary curves, has been generalized to hyperelliptic curves [14] as well. Although the Eta and Ate pairings hold the record for speed at the present time, we will focus our attention on the Tate pairing in this paper.…”