Paper 2008/490

On the final exponentiation for calculating pairings on ordinary elliptic curves

Michael Scott, Naomi Benger, Manuel Charlemagne, Luis J. Dominguez Perez, and Ezekiel J. Kachisa


When using pairing-friendly ordinary elliptic curves to compute the Tate and related pairings, the computation consists of two main components, the Miller loop and the so-called final exponentiation. As a result of good progress being made to reduce the Miller loop component of the algorithm (particularly with the discovery of ``truncated loop'' pairings like the R-ate pairing), the final exponentiation has become a more significant component of the overall calculation. Here we exploit the structure of pairing friendly elliptic curves to reduce the computation required for the final exponentiation to a minimum.

Note: Thanks to Yu Chen and Fre Vercauteren for pointing out an error in the sign of x for the BN curves.

Available format(s)
Publication info
Published elsewhere. Unknown where it was published
Tate Pairing
Contact author(s)
mike @ computing dcu ie
2010-08-24: last of 4 revisions
2008-11-24: received
See all versions
Short URL
Creative Commons Attribution


      author = {Michael Scott and Naomi Benger and Manuel Charlemagne and Luis J.  Dominguez Perez and Ezekiel J.  Kachisa},
      title = {On the final exponentiation for calculating pairings on ordinary elliptic curves},
      howpublished = {Cryptology ePrint Archive, Paper 2008/490},
      year = {2008},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.