Paper 2008/019

Computing Pairings Using x-Coordinates Only

Steven D. Galbraith and Xibin Lin

Abstract

To reduce bandwidth in elliptic curve cryptography one can transmit only $x$-coordinates of points (or $x$-coordinates together with an extra bit). For further computation using the points one can either recover the $y$-coordinates by taking square roots or one can use point multiplication formulae which use $x$-coordinates only. We consider how to efficiently use point compression in pairing-based cryptography. We give a method to compute compressed Weil pairings using $$-coordinates only. We also show how to compute the compressed Tate and ate pairings using only one $$-coordinate. Our methods are more efficient than taking square roots when the embedding degree is small. We implemented the algorithms in the case of embedding degree 2 curves over $$ where $$ and found that our methods are $$ faster than the analogous methods using square roots.