Faster Ate Pairing Computation over Pairing-Friendly Elliptic Curves Using GLV Decomposition

Abstract

The preexisting pairings ate, atei, R-ate, and optimal-ate use q-expansion, where q is the size of the defining field for the elliptic curves. Elliptic curves with small embedding degrees only allow a few of these pairings. In such cases, efficiently computable endomorphisms can be used, as in [11] and [12]. They used the endomorphisms that have characteristic polynomials with very small coefficients, which led to some restrictions in finding various pairing-friendly curves. To construct more pairing-friendly curves, we consider μ-expansion using the Gallant-Lambert-Vanstone (GLV) decomposition method, where μ is an arbitrary integer. We illustrate some pairing-friendly curves that provide more efficient pairing from the μ-expansion than from the ate pairing. The proposed method can achieve timing results at least 20% faster than the ate pairing.