Faster computation of the Tate pairing

Recently there are lots of studies on the Tate pairing computation with different coordinate systems, such as twisted Edwards curves and Hessian curves coordinate systems. However, Jacobi intersections curves coordinate system, as another useful one, is overlooked in pairing-based cryptosystems.This paper proposes the explicit formulae for the doubling and addition steps in Miller’s algorithm to compute the Tate pairing on twisted Jacobi intersections curves, as a larger class containing Jacobi intersections curves. Although these curves are not plane elliptic curves, our formulae are still very efficient and competitive with others. When the embedding degree is even, our doubling formulae are the fastest except for the formulae on Hessian/Selmer curves, and the parallel execution of our formulae are even more competitive with the Selmer curves case in the parallel manner. Besides, we give the detailed analysis of the fast variants of our formulae with other embedding degrees, such as the embedding degree 1, and the embedding degree dividing 4 and 6. At last, we analyze the relation between the Tate pairings on two isogenous elliptic curves, and show that the Tate pairing on twisted Jacobi intersections curves can be substituted for the Tate pairing on twisted Edwards curves completely.KeywordsTwisted Jacobi intersections curvesTate pairingMiller’s function

In this paper, we construct the twists of twisted Edwards curves in Weierstrass form. Then we define a new twisted Ate pairing on twisted Weierstrass curves named the Tx-Ate pairing. Following Miller's algorithm, we give a computation of the Tx-Ate pairing on high degree twisted Weierstrass curves, where the point operations are over Edwards form, and the computation of Miller function is over Weierstrass form. Although, in one doubling loop, our method to compute the Tx-Ate pairing is a litter slower than the previously fastest method. By twists, the Tx-Ate pairing can be calculated on more twisted Weierstrass curves with short loop length. The TxAte pairing is even competitive with optimal Ate pairing when they have the same short loop length.

This research addresses the computationallyeffective implementation of cryptographic protocols based on elliptic curves, and targets in particular cryptosystems that should be hosted on embedded programmable processors. In principle, the implementation of Elliptic Curve Cryptography
\n(ECC) requires one to deal with different design options, which stem from the available degrees of freedom: elliptic curve family, coordinate system, and point multiplication procedure. On the other hand, theoretical studies already proved that exist only a few setups leading to computational efficient implementations. The goal of present paper is to analyze from an applicative point of view such setups, which mainly involve two specific
\nfamilies of elliptic curves: Edwards curves and extend Jacobi quartic curves. The presented experimental session shows a few interesting outcomes; first, ECC schemes implemented by using either Edwards curves or extended Jacobi quartic curves can obtain remarkable performances in terms of computational efficiency also on low-cost, low-resources processors. Second, the experiments showed that in some cases the number of Fp operations is not enough to accurately estimate the overall performance of an ECC-based cryptosystem.

The properties of the Tate pairing are applied to various cryptographic systems. The problem is that the Tate pairing computation is expensive operation, and various methods for faster computation have been proposed. However their actual methods are not so clear. In this paper, we combined their methods and our technique for implementation to apply the program of computing Tate pairing. We evaluated the performance and compared the contribution of each method. There is a case, which yields slower computation caused by overheads of implementation. Consequently we obtained the result of 70% reduction of calculation of Tate pairing in total and showed that Tate pairing has practical applicability.

The Weil and Tate pairings have found several new applications in cryptography. A new identity-based signature scheme is presented in the paper. In the signature scheme, the signing process doesn't need to compute Tate pairing, so the efficiency of the signature scheme is higher than other identity-based signature scheme. Moreover, a new Implementation algorithm for computing Tate pairing is given in the paper, which is faster than Miller's algorithm that is the best-known general methods. Finally, the security of the signature scheme is analyzed.

The efficient computation of the Tate pairing is a crucial factor to realize cryptographic applications practically. To compute the Tate pairing, two kinds of costs on the scalar multiplications and Miller's line functions of elliptic curves should be considered. In the present paper, encapsulated scalar multiplications and line functions are discussed. Some simplified formulas and improved algorithms to compute f3T, f4T, f2T±P, f6T, f3T±P and f4T±P etc., are presented from given points T and P on the elliptic curve.

Montgomery curves allow efficient and side-channel resistant computation of ECDH using the Montgomery ladder. But the addition law of a Montgomery curve derived from the chord-tangent method is less efficient than other curve models such as a short Weierstrass curve and an Edwards curve. So, the usage of a Montgomery curve is strictly limited to ECDH only, such as \(\mathsf {X25519}\) and \(\mathsf {X448}\) functions in IETF RFC 7748. For other operations including fixed-base and multiple scalar multiplications, their birationally-equivalent (twisted) Edwards curves are recommended for use since the conversions between Montgomery curves and their Edwards equivalents are simple. This conversion enables the use of the efficient complete addition law of the Edwards curve that works for all pairs of input points with no exceptional cases. As a result, the combination allows secure and exception-free implementations, but at the expense of additional storage for the two curve parameters and for the conversion between them. However, smart devices in IoT environments that mainly operate ECDH (for example, RawPublicKey mode of IETF RFC 7250) do not need to implement such a conversion if a complete addition law does exist for the Montgomery curves.

The Tate pairing is used to reduce the discrete logarithm (DL) problem on certain elliptic curves to the DL in the multiplicative group of finite fields.

A generalisation of Miller's algorithm and applications to pairing computations on abelian varieties

Conventional Elliptic Curve (EC) cryptosystems are subjected to side channel attacks because of their lack of unifiedness. On the other hand, unified cryptosystems based on Edwards curves have been found to be slow. The present paper proposes the first VLSI design of binary Huff curves, which also lead to unified scalar multiplication. Several optimized architectural features have been developed to utilize the FPGA resources better, and yet lead to a faster circuit. Experimental results have been presented on the standard NIST curves, and on state-of-the-art GF(2233) to show that the design is significantly faster than other unified EC cryptosystems.

Developing a high-speed elliptic curve cryptographic (ECC) processor that performs fast point multiplication with low hardware utilization is a crucial demand in the fields of cryptography and network security. This paper presents field-programmable gate array (FPGA) implementation of a high-speed, low-area, side-channel attacks (SCAs) resistant ECC processor over a prime field. The processor supports 256-bit point multiplication on recently recommended twisted Edwards curve, namely, Edwards25519, which is used for a high-security digital signature scheme called Edwards curve digital signature algorithm (EdDSA). The paper proposes novel hardware architectures for point addition and point doubling operations on the twisted Edwards curve, where the processor takes only 516 and 1029 clock cycles to perform each point addition and point doubling, respectively. For a 256-bit key, the proposed ECC processor performs single point multiplication in 1.48 ms, running at a maximum clock frequency of 177.7 MHz in a cycle count of 262 650 with a throughput of 173.2 kbps, utilizing only 8873 slices on the Xilinx Virtex-7 FPGA platform, where the points are represented in projective coordinates. The implemented design is time-area-efficient as it offers fast scalar multiplication with low hardware utilization without compromising the security level.

Subgroup membership testing on elliptic curves via the Tate pairing

Elliptic net is a generalization of elliptic divisibility sequence and in cryptography field, most cryptographic pairings that are based on elliptic curve such as Tate pairing can be improved by applying elliptic nets algorithm. The elliptic net is constructed by using n dimensional array of values in rational number satisfying nonlinear recurrence relations that arise from elliptic divisibility sequences. The two main properties hold in the recurrence relations are for all positive integers m>n, hm+nhm−n=hm+1hm−1hn2−hn+1hn−1hm2 and hn divides hm whenever n divides m. In this research, we discuss elliptic divisibility sequence associated with elliptic nets based on cryptographic perspective and its possible research direction.

In this paper, we present a closed formula for the Tate pairing computation for supersingular elliptic curves defined over the binary field $\mathbb F_{2^m}$ of odd dimension. There are exactly three isomorphism classes of supersingular elliptic curves over $\mathbb F_{2^m}$ for odd m and our result is applicable to all these curves.

Acceleration of a pairing calculation of an Ate-based pairing such as Optimal Ate pairing depends not only on the optimization of Miller algorithm's loop parameter but also on efficient elliptic curve arithmetic operation and efficient final exponentiation. Some recent works have shown the implementation of Optimal Ate pairing over Kachisa-Schaefer-Scott KSS curve of embedding degree 18. Pairing over KSS curve is regarded as the basis of next generation security protocols. This paper has proposed a pseudo 12-sparse multiplication to accelerate Miller's loop calculation in KSS curve by utilizing the property of rational point groups. In addition, this papers has showed an enhancement of the elliptic curve addition and doubling calculation in Miller's algorithm by applying implicit mapping of its sextic twisted isomorphic group. Moreover this paper has implemented the proposal with recommended security parameter settings for KSS curve at 192 bit security level. The simulation result shows that the proposed pseudo 12-sparse multiplication gives more efficient Miller's loop calculation of an Optimal Ate pairing operation along with recommended parameters than pairing calculation without sparse multiplication.