On Computing Products of Pairings

R Granger; N. P.  Smart

Paper 2006/172

On Computing Products of Pairings

R Granger and N. P. Smart

Abstract

In many pairing-based protocols often the evaluation of the product of many pairing evaluations is required. In this paper we consider methods to compute such products efficiently. Focusing on pairing-friendly fields in particular, we evaluate methods for the Weil, Tate and Ate pairing algorithms for ordinary elliptic curves at various security levels. Our operation counts indicate that the minimal cost of each additional pairing relative to the cost of one is $\approx 0.61$, $0.45$, and $0.43$, for each of these pairings respectively at the 128-bit security level. For larger security levels the Ate pairing can have a relative additional cost of as low as $0.13$ for each additional pairing. These estimates allow implementors to make optimal algorithm choices for given scenarios, in which the number of pairings in the product, the security level, and the embedding degree are factors under consideration.

Metadata

Available format(s): PDF PS
Category: Implementation
Publication info: Published elsewhere. Unknown where it was published
Keywords: pairings
Contact author(s): nigel @ cs bris ac uk
History: 2006-05-17: revised; 2006-05-17: received; See all versions
Short URL: https://ia.cr/2006/172
License: CC BY

BibTeX

@misc{cryptoeprint:2006/172,
      author = {R Granger and N. P.  Smart},
      title = {On Computing Products of Pairings},
      howpublished = {Cryptology ePrint Archive, Paper 2006/172},
      year = {2006},
      note = {\url{https://eprint.iacr.org/2006/172}},
      url = {https://eprint.iacr.org/2006/172}
}