Fast Ate Pairing Computation of Embedding Degree 12 Using Subfield-Twisted Elliptic Curve

Akane, Masataka; Nogami, Yasuyuki; Morikawa, Yoshitaka

doi:10.1587/transfun.e92.a.508

Cited by 24 publications

(12 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Thus, points in G 2 can be represented by their image under Ψ − 1 . In what follows, we write P for the point on the twist E corresponding to a point P ∈ E, i. e. P = Ψ −1 (P ) and P = Ψ (P ).…”

Section: Background On Pairingsmentioning

confidence: 99%

“…If denominator elimination is used for d = 6, the values differ by ω 3 which lies in a subfield. For k = 12 and BN curves this case was considered by Akane, Nogami, and Morikawa [1] who showed that up to constants from subfields a T (Q, P ) = a T (Q , P ).…”

Section: Corollary 2 If a T (Q P ) Is Bilinear And Non-degenerate mentioning

confidence: 99%

“…For BN curves [8], Akane, Nogami, and Morikawa showed in [1] that the ate pairing itself can be computed on the twisted curve. Our result covers more general curves but computes the ate pairing only up to a power.…”

Section: Introductionmentioning

confidence: 99%

“…In this paper we consider these two cases separately to give specialized pairing formulas in both scenarios. In particular, we achieve the fastest known formulas for computing pairings on general curves with b = 0 in weight- (1,2) coordinates. In addition, the point doubling formulas we derive for curves of this form are currently the fastest published point doubling formulas [10] across all forms of elliptic curves.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Faster Pairing Computations on Curves with High-Degree Twists

Costello

Lange

Naehrig

2010

Public Key Cryptography – PKC 2010

100

View full text Add to dashboard Cite

Abstract. Research on efficient pairing implementation has focussed on reducing the loop length and on using high-degree twists. Existence of twists of degree larger than 2 is a very restrictive criterion but luckily constructions for pairing-friendly elliptic curves with such twists exist. In fact, Freeman, Scott and Teske showed in their overview paper that often the best known methods of constructing pairing-friendly elliptic curves over fields of large prime characteristic produce curves that admit twists of degree 3, 4 or 6.A few papers have presented explicit formulas for the doubling and the addition step in Miller's algorithm, but the optimizations were all done for the Tate pairing with degree-2 twists, so the main usage of the high-degree twists remained incompatible with more efficient formulas.In this paper we present efficient formulas for curves with twists of degree 2, 3, 4 or 6. These formulas are significantly faster than their predecessors. We show how these faster formulas can be applied to Tate and ate pairing variants, thereby speeding up all practical suggestions for efficient pairing implementations over fields of large characteristic.

show abstract

Section: Background On Pairingsmentioning

confidence: 99%

Section: Corollary 2 If a T (Q P ) Is Bilinear And Non-degenerate mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Faster Pairing Computations on Curves with High-Degree Twists

Costello

Lange

Naehrig

2010

Public Key Cryptography – PKC 2010

100

View full text Add to dashboard Cite

show abstract

“…G 1 × G 2 → G T is faster than the symmetric one [15]. Thus, in the implementation, we adopt the asymmetric type, and we utilize the fast pairing library called "Cross-twisted χ-based Ate (Xt-Xate) pairing" [11] with 254-bit group order and the embedding degree is 12. The security level is equivalent to the 128-bit AES.…”

Section: Utilized Pairing Librarymentioning

confidence: 99%

Accumulator for Monotone Formulas and its Application to Anonymous Credential System

Sadiah

Nakanishi

Begum

et al. 2017

Journal of Information Processing

View full text Add to dashboard Cite

An anonymous credential system allows a user to convince a service provider anonymously that he/she owns certified attributes. Previously, a system to prove AND and OR relations simultaneously by CNF formulas was proposed. To achieve a constant-size proof of the formula, this system adopts an accumulator that compresses multiple attributes into a single value. However, this system has a problem: the proof generation requires a large amount of computational time in the case of lots of OR literals in the formula. Therefore, we convert the attribute relation from the CNF formula to a monotone formula to decrease the number of OR literals. The monotone formula is a logic formula that contains any combination of AND and OR relations. In this paper, we propose an extended accumulator to prove the monotone formula, and apply it to the anonymous credential system. Our approach to prove the monotone formula is that the tag assignment in the accumulator is extended to be adapted to the tree expressing the monotone formula. Using this type of formula, the number of public parameters multiplied in the accumulator is decreased, which greatly impacts the reduction of authentication time.

show abstract

A Revocable Group Signature Scheme with Scalability from Simple Assumptions and Its Implementation

Emura

Hayashi

2018

Developments in Language Theory

View full text Add to dashboard Cite

Fast Ate Pairing Computation of Embedding Degree 12 Using Subfield-Twisted Elliptic Curve

Cited by 24 publications

References 16 publications

Faster Pairing Computations on Curves with High-Degree Twists

Faster Pairing Computations on Curves with High-Degree Twists

Accumulator for Monotone Formulas and its Application to Anonymous Credential System

A Revocable Group Signature Scheme with Scalability from Simple Assumptions and Its Implementation

Contact Info

Product

Resources

About