An Improvement of Twisted Ate Pairing Using Integer Variable with Small Hamming Weight

1
Two Improvements of Twisted Ate Pairing with
BarretoNaehrig Curve by Dividing Millers
Algorithm
Graduate School of Natural Science and
Technology Okayama University Yumi Sakemi,
Hidehiro Kato, Shoichi Takeuchi, Yasuyuki Nogami
and Yoshitaka Morikawa
2
Background

• Pairing based cryptography
• Identity(ID)-based cryptography (Sakai et al.
  2000)
• Group signature (Boneh et al. 2003)

???
expensive operation!!
Pairing
An efficient algorithm for pairing calculation is
required.
2
3
Elliptic Curve over Finite Field

• Finite fields

Prime field
Extension Field
embedding degree

• Elliptic curve over

Group of rational points on the curve
order of

? rational point
3
4
Pairing
Group1
e
Group3
order r
order r
Group2
order r
multiplicative
additive
4
5
Pairing
Group1
order r
Group3
order r
Group2
order r
5
6
Pairing
Group1
order r
Group3
order r
Group2
order r
6
7
Pairing
Bilinearity
Group1
order r
Group3
order r
Group2
order r
Innovative cryptographic applications are based
on bilinearity of pairing.
7
8
Pairing
Final exponentiation
Millers algorithm
Millers algorithm
Group1
order r
Group3
order r
Group2
order r
Several improvements for pairing
Ate
Weil
Tate
Twisted Ate
(2006)
(1994)
(1946)
(2006)
slow
fast
8
9
Barreto-Naehrig(BN) Curve

• Elliptic curve of k 12
• Parameters p, r and t of BN curve are given by
  integer variable as

9
10
Millers Algorithm
Input
i-th bit of the binary representation of s from
the lower
main loop
yes
no
additional operation
no
yes
Hw(s) is large ? computationally expensive
Output
Hw(s) Hamming Weight of s
10
11
Twisted Ate Pairing with BN Curve
We can select of small hamming weight.
integer
It is not easy to control the Hw(s) small !!
11
12
Improvement 1
Improvement 1 is based on divisor theorem
conventional method
Millers algorithm ( s )
Out put
12
13
Improvement 2
Millers algorithm ( ab )
Millers algorithm ( a )
fa
fb
Millers algorithm ( b )
combining
Output fab
12
14
Improvement 2
fs is given by fc and fp.
s ( 6c - 3 ) p ( 6c - 1)
s 36c3 - 18c2 6c - 1
conventional method
Millers algorithm ( s )
Out put
13
15
Computational environment
16
Experimental results
ms
-14.8
14
17
Conclusion

• We proposed two improvements for twisted Ate
  pairing.
• It was shown that they have almost the same
  efficiency.

16