Paper 2007/434

Computing the Ate Pairing on Elliptic Curves with Embedding Degree $k=9$

Xibin Lin, Chang-An Zhao, Fangguo Zhang, and Yanming Wang

Abstract

For AES 128 security level there are several natural choices for pairing-friendly elliptic curves. In particular, as we will explain, one might choose curves with $k=9$ or curves with $k=12$. The case $k=9$ has not been studied in the literature, and so it is not clear how efficiently pairings can be computed in that case. In this paper, we present efficient methods for the $k=9$ case, including generation of elliptic curves with the shorter Miller loop, the denominator elimination and speed up of the final exponentiation. Then we compare the performance of these choices. From the analysis, we conclude that for pairing-based cryptography at the AES 128 security level, the Barreto-Naehrig curves are the most efficient choice, and the performance of the case $k=9$ is comparable to the Barreto-Naehrig curves.

Metadata
Available format(s)
PDF PS
Publication info
Published elsewhere. Unknown where it was published
Keywords
Ate pairingDenominator eliminationFinal exponentiation
Contact author(s)
linxibin @ mail2 sysu edu cn
History
2007-11-24: revised
2007-11-24: received
See all versions
Short URL
https://ia.cr/2007/434
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2007/434,
      author = {Xibin Lin and Chang-An Zhao and Fangguo Zhang and Yanming Wang},
      title = {Computing the Ate Pairing on Elliptic Curves with Embedding Degree $k=9$},
      howpublished = {Cryptology ePrint Archive, Paper 2007/434},
      year = {2007},
      note = {\url{https://eprint.iacr.org/2007/434}},
      url = {https://eprint.iacr.org/2007/434}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.