Paper 2008/292

Another approach to pairing computation in Edwards coordinates

Sorina Ionica and Antoine Joux


The recent introduction of Edwards curves has significantly reduced the cost of addition on elliptic curves. This paper presents new explicit formulae for pairing implementation in Edwards coordinates. We prove our method gives performances similar to those of Miller's algorithm in Jacobian coordinates and is thus of cryptographic interest when one chooses Edwards curve implementations of protocols in elliptic curve cryptography. The method is faster than the recent proposal of Das and Sarkar for computing pairings on supersingular curves using Edwards coordinates.

Note: Thorough revision, taking into account reviewer feedback. This is an extended version of Indocrypt 2008 paper.

Available format(s)
Publication info
Published elsewhere. Unknown where it was published
elliptic curveEdwards curvespairings
Contact author(s)
sorina ionica @ m4x org
2009-02-13: last of 3 revisions
2008-07-03: received
See all versions
Short URL
Creative Commons Attribution


      author = {Sorina Ionica and Antoine Joux},
      title = {Another approach to pairing computation in Edwards coordinates},
      howpublished = {Cryptology ePrint Archive, Paper 2008/292},
      year = {2008},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.