Improvement of Optimal-Ate Pairing on Cocks-Pinch Curve with Embedding Degree 6 in Affine Coordinates

Abstract

In recent years, several advanced cryptographic protocols that provides practical security and privacy features have been proposed. Pairing-based cryptography is one of the next generation public-key encryption methods that realize the high performance cryptographic protocols. Elliptic curves used in the pairing-based cryptography include pairing friendly curves with a wide variety of parameters. As a type of pairing friendly curves, Guillevic et al. presented parameters for Cocks-Pinch curve with embedding degree <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$k=5,6,7,8$</tex> . Furthermore, Nanjo et al. proposed that the computational cost of the pairing on the Cocks-Pinch curve with embedding degree <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$k=6$</tex> is the second candidate for the BLS curve with embedding degree <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$k=12$</tex> at the 128-bit security level. Therefore, the authors propose and improve Optimal-Ate pairing on Cocks-Pinch curve with embedding degree <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$k=6$</tex> in Affine coordinates. Specifically, Miller's algorithm for Optimal-Ate pairing is optimized for Cocks-Pinch curves, and an effective Pseudo 4-sparse multiplication is derived and implemented. We adopt and implement a compressed squaring, which efficiently computes the squares to the final exponentiation of Optimal-Ate pairing. Optimal-Ate pairing on Cocks-Pinch curves in Affine coordinates using the above efficient method is found to be more efficient than previous Optimal-Ate pairing on Cocks-Pinch curves in Affine coordinates.