Faster Pairing Computations on Curves with High-Degree Twists

Research on efficient pairing implementation has focussed on reducing the loop length and on using high-degree twists. Existence of twists of degree larger than 2 is a very restrictive criterion but luckily constructions for pairing-friendly elliptic curves with such twists exist. In fact, Freeman, Scott and Teske showed in their overview paper that often the best known methods of constructing pairing-friendly elliptic curves over fields of large prime characteristic produce curves that admit twists of degree 3, 4 or 6. A few papers have presented explicit formulas for the doubling and the addition step in Miller’s algorithm, but the optimizations were all done for the Tate pairing with degree-2 twists, so the main usage of the highdegree twists remained incompatible with more efficient formulas. In this paper we present efficient formulas for curves with twists of degree 2, 3, 4 or 6. These formulas are significantly faster than their predecessors. We show how these faster formula...

• Type: Conference
• Year: 2010
• Where: PKC
• Authors: Craig Costello, Tanja Lange, Michael Naehrig
• Keywords: Cryptology, Efficient Formulas, Efficient Pairing Implementations, Pairing-friendly Elliptic Curves, PKC 2010