Computing the Ate Pairing on Elliptic Curves with Embedding Degree k = 9

Abstract

Abstract. For AES 128 security level there are several natural choices for pairing-friendly elliptic curves. In particular, as we will explain, one might choose curves with k = 9 or curves with k = 12. The case k = 9has not been studied in the literature, and so it is not clear how efficiently pairings can be computed in that case. In this paper, we present efficient methods for the k = 9 case, including generation of elliptic curves with the shorter Miller loop, the denominator elimination and speed up of the final exponentiation. Then we compare the performance of these choices.From the analysis, we conclude that for pairing-based cryptography at the AES 128 security level, the Barreto-Naehrig curves are the most efficient choice, and the performance of the case k = 9 is comparable to the Barreto-Naehrig curves.

Speeding Up Ate Pairing Computation in Affine Coordinates

“…Pairing computation over cubic twisted curves with embedding degrees 9 or 15 were investigated in papers [26][12] [11]. Although such curves only admit a cubic twist d = 3, and there exists no full denominators elimination technique, but they provide a shorter Miller loop.…”

“…Recall that cubic twisted curves have the form y 2 = x 3 + b. In [26], Lin et al proposed a denominators elimination trick during Ate pairing computation on a k = 9 curve due to the following observation about the factor 1/v R+Q (P ):…”

“…This formula needs one full extension field multiplication than the full denominators elimination technique of Barreto et al [2]. The following lemma allows us to save one multiplication in the full extension field in comparison to the analysis in [26].…”

“…The actual updated factor is x 2 R+Q + x R+Q x P + x 2 P − λ(y P − y R+Q ). The computation of this updated factor doesn't require one more multiplication in the full extension field and it is much faster than that given in [26]. Doubling step.…”

“…Example 1. In the case of k = 9, we can obtain pairing-friendly elliptic curves of form y 2 = x 3 +b admitting a cubic twist [26]. During Ate pairing computation, point operations are performed over F p 3 (i.e., e = 3).…”