Pairing Computation on Elliptic Curves with Efficiently Computable Endomorphism and Small Embedding Degree

Ionica, Sorina; Joux, Antoine

doi:10.1007/978-3-642-17455-1_27

Cited by 5 publications

(9 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The reduced Tate pairing is defined as Recall the pairings by q-expansion from [10], [12], [13], [16]. Let π q be the Frobenius endomorphism:…”

Section: Pairingsmentioning

confidence: 99%

“…Ionica and Joux [12] extended Scott's method to other classes of curves with k=2, 4 and efficiently computable endomorphisms. Ionica and Joux [12] extended Scott's method to other classes of curves with k=2, 4 and efficiently computable endomorphisms.…”

Section: Pairingsmentioning

confidence: 99%

“…Scott [11] and Ionica and Joux [12] took D=1, 3, where an efficiently computable endomorphism is defined. This endomorphism is as efficient as the Frobenius endomorphism.…”

Section: Setmentioning

confidence: 99%

“…In pairing computation, one can also consider other efficiently computable endomorphisms instead of the Frobenius map. Ionica and Joux [12] extended Scott's method to other classes of curves with k=2, 4. The pairing is constructed by choosing λ as an integer of the form 2 i or 2 i +2 j and the prime r as a factor of λ 2 +λ+1.…”

Section: Introductionmentioning

confidence: 99%

“…Notably, for small embedding degrees, there are a few choices of the "ate" pairings since the length of q-expansion is bounded by k. Furthermore, there has only been known to be a small set of curves with efficiently computable endomorphisms in explicit formulae [15]. In fact, lacking a large prime r to satisfy the conditions for a given λ resulted in [12] not providing new pairing-friendly curves to sufficiently satisfy the security level requirement. Therefore, it is not guaranteed for most pairingfriendly curves with small embedding degrees to satisfy the conditions for both λ and the endomorphism.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Faster Ate Pairing Computation over Pairing-Friendly Elliptic Curves Using GLV Decomposition

Eom¹

2013

ETRI J

View full text Add to dashboard Cite

The preexisting pairings ate, atei, R‐ate, and optimal‐ate use q‐expansion, where q is the size of the defining field for the elliptic curves. Elliptic curves with small embedding degrees only allow a few of these pairings. In such cases, efficiently computable endomorphisms can be used, as in [11] and [12]. They used the endomorphisms that have characteristic polynomials with very small coefficients, which led to some restrictions in finding various pairing‐friendly curves. To construct more pairing‐friendly curves, we consider μ‐expansion using the Gallant‐Lambert‐Vanstone (GLV) decomposition method, where μ is an arbitrary integer. We illustrate some pairing‐friendly curves that provide more efficient pairing from the μ‐expansion than from the ate pairing. The proposed method can achieve timing results at least 20% faster than the ate pairing.

show abstract

“…The reduced Tate pairing is defined as Recall the pairings by q-expansion from [10], [12], [13], [16]. Let π q be the Frobenius endomorphism:…”

Section: Pairingsmentioning

confidence: 99%

Section: Pairingsmentioning

confidence: 99%

“…Scott [11] and Ionica and Joux [12] took D=1, 3, where an efficiently computable endomorphism is defined. This endomorphism is as efficient as the Frobenius endomorphism.…”

Section: Setmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations