Optimal Ate Pairing on Elliptic Curves with Embedding Degree $9,15$ and $27$

Abstract

Much attention has been given to the efficient computation of pairings on elliptic curves with even embedding degree since the advent of pairing-based cryptography. The few existing works in the case of odd embedding degrees require some improvements. This paper considers the computation of optimal ate pairings on elliptic curves of embedding degrees $k=9$, $15$, $27$ which have twists of order three. Our main goal is to provide a detailed arithmetic and cost estimation of operations in the tower extensions field of the corresponding extension fields. A good selection of parameters enables us to improve the theoretical cost for the Miller step and the final exponentiation using the lattice-based method as compared to the previous few works that exist in these cases. In particular, for $k=15$, $k=27$, we obtain an improvement, in terms of operations in the base field, of up to 25% and 29% respectively in the computation of the final exponentiation. We also find that elliptic curves with embedding degree $k=15$ present faster results than BN12 curves at the 128-bit security level. We provide a MAGMA implementation in each case to ensure the correctness of the formulas used in this work. Comment: 25 pages

Restrictions of Integer Parameters for Generating Attractive BLS Subfamilies of Pairing-Friendly Elliptic Curves with Specific Embedding Degrees

“…( 13 Theorem 8 Suppose that the tower of extension fields is constructed as in Theorem 6 and E/F p(x0) be the BLS curve determined as in Theorem 7. Then, the correct twist E /F p(x0) 2 m−1 of degree 6 of E can be determined as follows: For m = 1, (12).…”

“…Pairings on elliptic curves enable innovative protocols, e.g., IDbased encryption [9], group signature authentication [7], searchable encryption [8], attribute-based encryption [15], and homomorphic encryption [32]. Since these pairing-based protocols can be indirectly improved through the improvement of the pairings, researchers have been working on methods to construct several families of pairing-friendly elliptic curves [3,4,13,22], optimizations of the pairing algorithm [10,14,20,21,28,34,38], security analyses [1,2,12,17,18], and so on. As one of recent works of the pairings, in [1], Barbulescu and Duquesne analyzed the key size of the pairings that have resistance against an attack for a discrete logarithm problem given by Kim et al in [24].…”

“…As one of recent works of the pairings, in [1], Barbulescu and Duquesne analyzed the key size of the pairings that have resistance against an attack for a discrete logarithm problem given by Kim et al in [24]. Starting with this, researchers have been worked on the security analyses and gave recommendations of the elliptic curves in [2,12,17,18]. According to these results, one of the parametric families of pairingfriendly elliptic curves given by Barreto, Lynn, and Scott in [3], which is so-called the BLS family, is often used for the pairings at the various security levels.…”

Constructing suitable parameters for pairing-based cryptography

“…This is mainly the reason why most papers that deal with optimal pairings (e.g. [Fouotsa et al, 2017, Menezes et al, 2016, Vercauteren, 2010) use examples of elliptic curves derived from complete families.…”

“…Their relatively small CM-discriminant have made complete families the most attractive type of families for applications. Almost every paper that deals with efficient pairing computations such as [Fouotsa et al, 2017, Vercauteren, 2010 uses pairings defined on elliptic curves which are obtained from complete families. Although the most famous example is the BN family [Barreto and Naehrig, 2005] for k = 12, recently there have been a few other candidates as well, mainly from the constructions in [Kachisa et al, 2008].…”