The Weil Pairing, and Its Efficient Calculation

Miller, Victor S.

doi:10.1007/s00145-004-0315-8

Cited by 431 publications

(219 citation statements)

References 15 publications

Supporting

Mentioning

211

Contrasting

Unclassified

Order By: Relevance

“…Miller [19,20] proposed an algorithm that constructs f r,P in stages by using a double-and-add method. When generalizing the denominator-free version […”

Section: Preliminariesmentioning

confidence: 99%

See 1 more Smart Citation

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Aranha

Karabina²,

Longa

et al. 2011

Advances in Cryptology – EUROCRYPT 2011

135

176

View full text Add to dashboard Cite

Abstract. We describe e cient formulas for computing pairings on ordinary elliptic curves over prime elds. First, we generalize lazy reduction techniques, previously considered only for arithmetic in quadratic extensions, to the whole pairing computation, including towering and curve arithmetic. Second, we introduce a new compressed squaring formula for cyclotomic subgroups and a new technique to avoid performing an inversion in the nal exponentiation when the curve is parameterized by a negative integer. The techniques are illustrated in the context of pairing computation over Barreto-Naehrig curves, where they have a particularly e cient realization, and also combined with other important developments in the recent literature. The resulting formulas reduce the number of required operations and, consequently, execution time, improving on the state-of-the-art performance of cryptographic pairings by 27%-33% on several popular 64-bit computing platforms. In particular, our techniques allow to compute a pairing under 2 million cycles for the rst time on such architectures.

show abstract

“…Miller [19,20] proposed an algorithm that constructs f r,P in stages by using a double-and-add method. When generalizing the denominator-free version […”

Section: Preliminariesmentioning

confidence: 99%

“…Miller's Algorithm [19,20] employs arithmetic in F p 12 during the accumulation steps (lines 3,5,11-12 in Algorithm 1) and at the nal exponentiation (line 13 in the same algorithm). Hence, to achieve a high-performance implementation of pairings it is crucial to perform arithmetic over extension elds e ciently.…”

Section: ] Ofmentioning

confidence: 99%

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Aranha

Karabina²,

Longa

et al. 2011

Advances in Cryptology – EUROCRYPT 2011

135

176

View full text Add to dashboard Cite

show abstract

“…The computation of a T (ψ(Q ), P ) consists of two parts: evaluation of the function f T,Q at P and final exponentiation ensuring a unique result of the pairing. The first part is computed using Miller's algorithm [27] that is described in Algorithm 1. [35] in high security levels, affine coordinates could be much faster than projective coordinates.…”

Section: The Ate Pairingmentioning

confidence: 99%

Speeding Up Ate Pairing Computation in Affine Coordinates

Tan

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. At Pairing 2010, Lauter et al's analysis showed that Ate pairing computation in affine coordinates may be much faster than projective coordinates at high security levels. In this paper, we further investigate techniques to speed up Ate pairing computation in affine coordinates. On the one hand, we improve Ate pairing computation over elliptic curves admitting an even twist by describing an 4-ary Miller algorithm in affine coordinates. This technique allows us to trade one multiplication in the full extension field and one field inversion for several multiplications in a smaller field. On the other hand, we investigate pairing computations over elliptic curves admitting a twist of degree 3. We propose new fast explicit formulas for Miller function that are comparable to formulas over even twisted curves. We further analyze pairing computation on cubic twisted curves by proposing efficient subfamilies of pairing-friendly elliptic curves with embedding degrees k = 9, and 15. These subfamilies allow us not only to obtain a very simple form of curve, but also lead to an efficient arithmetic and final exponentiation.

show abstract

“…However, in all known realizations of the pairing, it turns out that when computing multiple pairings in a product, the cost incurred by adding each extra pairing is significantly lesser than the cost of the first pairing. The reason is because the sequence of doublings in Miller's algorithm [Mil04] can be amortized over all the pairings in a given product, in a very similar way to the multi-exponentiation algorithm. To push this idea further, it is possible to batch the k remaining equations into a single "multi-pairing", using randomization, at the cost of k extra exponentiations in G: to check that ∀i = 1, .…”

Section: Fast Verificationmentioning

confidence: 99%

Compact Group Signatures Without Random Oracles

Boyen¹,

Waters

2006

Advances in Cryptology - EUROCRYPT 2006

184

145

View full text Add to dashboard Cite

Abstract. We present the first efficient group signature scheme that is provably secure without random oracles. We achieve this result by combining provably secure hierarchical signatures in bilinear groups with a novel adaptation of the recent Non-Interactive Zero Knowledge proofs of Groth, Ostrovsky, and Sahai. The size of signatures in our scheme is logarithmic in the number of signers; we prove it secure under the Computational Diffie-Hellman and the Subgroup Decision assumptions in the model of Bellare, Micciancio, and Warinshi, as relaxed by Boneh, Boyen, and Shacham.

show abstract

The Weil Pairing, and Its Efficient Calculation

Cited by 431 publications

References 15 publications

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Speeding Up Ate Pairing Computation in Affine Coordinates

Compact Group Signatures Without Random Oracles

Contact Info

Product

Resources

About