Efficient Implementation of Bilinear Pairings on ARM Processors

Abstract

Abstract. As hardware capabilities increase, low-power devices such as smartphones represent a natural environment for the efficient implementation of cryptographic pairings. Few works in the literature have considered such platforms despite their growing importance in a post-PC world. In this paper, we investigate the efficient computation of the Optimal-Ate pairing over Barreto-Naehrig curves in software at different security levels on ARM processors. We exploit state-of-the-art techniques and propose new optimizations to speed up the computation in the tower field and curve arithmetic. In particular, we extend the concept of lazy reduction to inversion in extension fields, analyze an efficient alternative for the sparse multiplication used inside the Miller's algorithm and reduce further the cost of point/line evaluation formulas in affine and projective homogeneous coordinates. In addition, we study the efficiency of using M-type sextic twists in the pairing computation and carry out a detailed comparison between affine and projective coordinate systems. Our implementations on various mass-market smartphones and tablets significantly improve the state-of-the-art of pairing computation on ARM-powered devices, outperforming by at least a factor of 3.7 the best previous results in the literature.

Efficient Pairings and ECC for Embedded Systems

“…It is however hard to compare the quality of an Other pairing implementations for 32-bit ARM processors are limited to the Cortex-A series, such as in [20]. However, their pairing's runtime of 9.9 ms on a 1.2 GHz Cortex-A9 is as well hardly comparable with our pairing's runtime on the Cortex-M0+ since the multi-core Cortex-A processors provide massively higher clock frequencies along with a more powerful instruction set.…”

“…Therefore, researchers started to implement optimized pairing operations for desktop computers [1,6], for smart phones [20,31], and as dedicated hardware modules [16,24]. Cost-sensitive embedded applications however simply do not have the budget for such powerful application processors or 130-180 kGE of dedicated hardware.…”

NEON Implementation of an Attribute-Based Encryption Scheme

“…Our library was specifically tailored for computing optimal pairings over Barreto-Naehrig curves at the 127-bit security level. When executed on a developing board that hosts a 1.7 GHz Exynos 5 Cortex-A15 processor, our software computes a single optimal pairing in approximately 5.82M clock cycles, which is about two times less than the estimated cycling count reported in [13] for a single pairing computation over a TI 1.2GHz OMAP 4460 Cortex-A9 processor.…”

“…Among the research papers reporting pairing implementations in the ARM Cortex family of processors are [1] and [13]. In [1], the authors advocate the use of affine coordinates could be more attractive than the projective ones when implementing pairings in constrained devices, whereas the software library of [13] reports the current record in the computation of a single asymmetric pairing at the 128, 224 and 320-bit security levels.…”

“…In [1], the authors advocate the use of affine coordinates could be more attractive than the projective ones when implementing pairings in constrained devices, whereas the software library of [13] reports the current record in the computation of a single asymmetric pairing at the 128, 224 and 320-bit security levels. As for the implementation of pairingbased protocols on mobile devices, the only work that we are aware of is [2], where the authors described the design of an attribute-based encryption scheme able to preserve the confidentiality of the medical electronic records generated within a hospital environment.…”