A Taxonomy of Pairing-Friendly Elliptic Curves

Freeman, David; Scott, Michael; Teske, Edlyn

doi:10.1007/s00145-009-9048-z

Cited by 347 publications

(401 citation statements)

References 80 publications

Supporting

Mentioning

384

Contrasting

Unclassified

Order By: Relevance

“…Even though the techniques are applied on pairings over BN curves at the 128-bit security level, they can be easily extended to other settings using di erent curves and higher security levels [15].…”

Section: Introductionmentioning

confidence: 99%

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Aranha

Karabina²,

Longa

et al. 2011

Advances in Cryptology – EUROCRYPT 2011

131

176

View full text Add to dashboard Cite

Abstract. We describe e cient formulas for computing pairings on ordinary elliptic curves over prime elds. First, we generalize lazy reduction techniques, previously considered only for arithmetic in quadratic extensions, to the whole pairing computation, including towering and curve arithmetic. Second, we introduce a new compressed squaring formula for cyclotomic subgroups and a new technique to avoid performing an inversion in the nal exponentiation when the curve is parameterized by a negative integer. The techniques are illustrated in the context of pairing computation over Barreto-Naehrig curves, where they have a particularly e cient realization, and also combined with other important developments in the recent literature. The resulting formulas reduce the number of required operations and, consequently, execution time, improving on the state-of-the-art performance of cryptographic pairings by 27%-33% on several popular 64-bit computing platforms. In particular, our techniques allow to compute a pairing under 2 million cycles for the rst time on such architectures.

show abstract

Section: Introductionmentioning

confidence: 99%

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Aranha

Karabina²,

Longa

et al. 2011

Advances in Cryptology – EUROCRYPT 2011

131

176

View full text Add to dashboard Cite

show abstract

“…The first wave of this research exhausted many tricks that can be applied inside a Miller iteration, resulting in significant computational speed ups [4,6,7,34]. The second wave of improvements focussed on constructing pairingfriendly elliptic curves [5,11,37,16,8,22,9,17,28], and this research is extended and collected in [18]. The third and more recent wave of research has focussed on reducing the loop length of Miller's algorithm [35,26,3,32] to be as short as possible [42,25].…”

Section: Introductionmentioning

confidence: 99%

Faster Pairing Computations on Curves with High-Degree Twists

Costello

Lange

Naehrig

2010

Public Key Cryptography – PKC 2010

100

View full text Add to dashboard Cite

Abstract. Research on efficient pairing implementation has focussed on reducing the loop length and on using high-degree twists. Existence of twists of degree larger than 2 is a very restrictive criterion but luckily constructions for pairing-friendly elliptic curves with such twists exist. In fact, Freeman, Scott and Teske showed in their overview paper that often the best known methods of constructing pairing-friendly elliptic curves over fields of large prime characteristic produce curves that admit twists of degree 3, 4 or 6.A few papers have presented explicit formulas for the doubling and the addition step in Miller's algorithm, but the optimizations were all done for the Tate pairing with degree-2 twists, so the main usage of the high-degree twists remained incompatible with more efficient formulas.In this paper we present efficient formulas for curves with twists of degree 2, 3, 4 or 6. These formulas are significantly faster than their predecessors. We show how these faster formulas can be applied to Tate and ate pairing variants, thereby speeding up all practical suggestions for efficient pairing implementations over fields of large characteristic.

show abstract

“…Also they cannot exploit higher order twists on low CM discriminant elliptic curves. Therefore it is usually preferred to choose instead from one of the families of pairing-friendly curves identified by numerous authors, and collated together in the taxonomy paper of Freeman et al [6]. These often have a ρ value closer to 1, and many are of the desirable low CM discriminant form.…”

Section: The Application To Ordinary Pairing Friendly Elliptic Curvesmentioning

confidence: 99%

Fast Hashing to G 2 on Pairing-Friendly Curves

Scott

Benger

Charlemagne

et al. 2009

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. When using pairing-friendly ordinary elliptic curves over prime fields to implement identity-based protocols, there is often a need to hash identities to points on one or both of the two elliptic curve groups of prime order r involved in the pairing. Of these G1 is a group of points on the base field E(F p ) and G 2 is instantiated as a group of points with coordinates on some extension field, over a twisted curve E (F p d ), where d divides the embedding degree k. While hashing to G 1 is relatively easy, hashing to G 2 has been less considered, and is regarded as likely to be more expensive as it appears to require a multiplication by a large cofactor. In this paper we introduce a fast method for this cofactor multiplication on G2 which exploits an efficiently computable homomorphism.

show abstract

A Taxonomy of Pairing-Friendly Elliptic Curves

Cited by 347 publications

References 80 publications

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Faster Explicit Formulas for Computing Pairings over Ordinary Curves

Faster Pairing Computations on Curves with High-Degree Twists

Fast Hashing to G 2 on Pairing-Friendly Curves

Contact Info

Product

Resources

About