Graduate School of Natural Science and Technology Okayama University Yumi Sakemi, Hidehiro Kato, Shoichi Takeuchi, Yasuyuki Nogami and Yoshitaka Morikawa Two Improvements of Twisted Ate Pairing with Barreto–Naehrig Curve by Dividing Miller’s Algorithm

Elliptic curve cryptography Finite field theory Background Pairing based cryptography Identity(ID)-based cryptography ( Sakai et al ) Group signature ( Boneh et al ) An efficient algorithm for pairing calculation is required. 2 expensive operation!! Pairing Pairing based cryptography

Elliptic Curve over Finite Field ○ Finite fields ○ Elliptic curve over ● ： rational point Prime field Extension Field order of ： 3 Group of rational points on the curve ： ： embedding degree

Pairing 4 Group 1 Group 2 Group 3 order= r e additive multiplicative

Pairing 5 Group 1 Group 2 Group 3 order = r

Pairing 6 Group 1 Group 2 Group 3 order = r

Pairing 7 Group 1 Group 2 Group 3 order = r Bilinearity Innovative cryptographic applications are based on bilinearity of pairing.

Pairing 8 Group 1 Group 2 Group 3 order = r Final exponentiation Miller’s algorithm Weil Tate Ate Twisted Ate slow fast Miller’s algorithm Several improvements for pairing (1946) (2006) (1994) (2006)

Barreto-Naehrig(BN) Curve Elliptic curve of k =12 Parameters p, r and t of BN curve are given by integer variable as 9

Miller’s Algorithm Output : i-th bit of the binary representation of s from the lower Hw(s) : Hamming Weight of s Hw(s) is large → computationally expensive 10 yes no yes no additional operation main loop Input :

Twisted Ate Pairing with BN Curve It is not easy to control the Hw(s) small !! 11 : integer We can select of small hamming weight.

Improvement 1 conventional method Miller’s algorithm ( s ) 12 Out put Improvement 1 is based on divisor theorem proposed method Miller’s algorithm ( ) Miller’s algorithm ( ) Miller’s algorithm ( ) Combining Output

Improvement 2 Miller’s algorithm ( a ) Miller’s algorithm ( ab ) Output f ab Miller’s algorithm ( b ) combining fafa fbfb f ab = f a b ･ f b An exponentiation is additionally required !! f ap = f a p ･ f p Frobenius mapping 12

Improvement 2 conventional method Miller’s algorithm ( s ) Out put 13 proposed method Miller’s algorithm ( ) Miller’s algorithm ( p ) combining and some calculations Output s = ( 6  － 3 ) p + ( 6  － 1) s = 36  3 － 18  2 ＋ 6  － 1 f s is given by f  and f p.

Computational environment

Experimental results [ms] % 14 conventionalImprovement 1Improvement 2 Miller’s algorithm Final exponentiation4.70 total

Conclusion ○ We proposed two improvements for twisted Ate pairing. ○ It was shown that they have almost the same efficiency. 16