Faster Ate Pairing Computation over Pairing-Friendly Elliptic Curves Using GLV Decomposition

Abstract

The preexisting pairings ate, atei, R‐ate, and optimal‐ate use q‐expansion, where q is the size of the defining field for the elliptic curves. Elliptic curves with small embedding degrees only allow a few of these pairings. In such cases, efficiently computable endomorphisms can be used, as in [11] and [12]. They used the endomorphisms that have characteristic polynomials with very small coefficients, which led to some restrictions in finding various pairing‐friendly curves. To construct more pairing‐friendly curves, we consider μ‐expansion using the Gallant‐Lambert‐Vanstone (GLV) decomposition method, where μ is an arbitrary integer. We illustrate some pairing‐friendly curves that provide more efficient pairing from the μ‐expansion than from the ate pairing. The proposed method can achieve timing results at least 20% faster than the ate pairing.