Miller's Algorithm Research Articles

Orientation Quaternion Norm Correction in SINS Algorithms: Calculation Normalization Schemes and Their Efficiency

The problem of correcting the norm of the computed orientation quaternion in the algorithms for the operation of strapdown inertial navigation systems is considered. Two existing approaches to the correction process are considered, the first approach is to normalize the rotation quaternion at the computation cycle, the second approach is to normalize the resulting quaternion. 5 well-known calculation schemes for norm correction are given. To simulate the test motion, we used an analytical quaternion kinematic rotation model based on a sequence of three rotations corresponding to the Krylov angles. The case of linear dependence of elementary rotation angles on time is considered. The model provides analytical representation of the projections of the angular velocity vector of the rigid body on the associated axes and the corresponding quasi-coordinates on the calculation cycle. The results of numerical simulation of the reference motion for a given set of frequencies are presented as dependences of the projections of the angular velocity vector of the rigid body on time and the constructed trajectories in the configuration space of the orientation parameters.
 To determine the rotation quaternion on a cycle, the Miller algorithm was used, which makes it possible to obtain an increase in the orientation vector based on ideal information from the angular velocity sensors in the form of quasi-coordinates. The transformation into a rotation quaternion occurs with the help of the corresponding expansions of the trigonometric functions of the true rotation angle (modulus of the orientation vector) in a series.
 Based on a numerical experiment, it is shown that the best result of correcting the norm of the calculated quaternion in the sense of the minimum error of the norm is given by one of the finite normalization schemes, for which there is no division operation and ensures the stability of the norm correction in time. The results of numerical simulation of the model rotational motion of a rigid body and the development of schemes for correcting the norm of the calculated orientation quaternion are presented.
 Keywords: orientation quaternion, Miller's orientation algorithm, SINS, norm error, computational drift, analytical reference model, quasi-coordinates, numerical simulation.

An Energy-Aware Nanoscale Design of Reversible Atomic Silicon Based on Miller Algorithm

Atomic silicon and reversible logic are domain field-coupled nanocomputing (FCN) techniques that have drawn significant attention for their lower power consumption, area, and design overhead. As atomic silicon and reversible logic reach dramatically reduced occupied area and power consumption, they can be a suitable alternative to CMOS technology. These technologies can significantly reduce the occupied area and energy consumption in all kinds of digital circuits, which are the two most challenging aspects of developing digital circuits. On the other hand, the Miller algorithm is a crucial synthesis for suggesting reversible circuits with extraordinary techniques in nanotechnology. It is an exceptionally effective and systematic method based on quantum rules for designing and proposing reversible circuits that can help suggest a reversible gate with low energy and a low occupied area. This study aims to construct novel nano-scale circuits with a focus on low-occupied area and minimal energy consumption as essential factors while designing digital circuits. In this paper, we propose a reversible gate with the well-known Miller algorithm and atomic silicon technology. Then it is used to develop a reversible full adder, 4-bit ripple carry adder, and 4:2 compressor. Finally, the proposed structures are simulated using the SiQAD tool.

Optimization and software-numerical implementation of miller's algorithm on a four-frequency model of solid vibration movement

On the basis of a programmed-numerical approach, new values of the coefficients in the Miller orientation algorithm are obtained. For this, an analytical reference model of the angular motion of a rigid body was applied in the form of a four-frequency representation of the orientation quaternion.The numerical implementation of the reference model for a given set of frequencies is presented in the form of constructed trajectories in the configuration space of orientation parameters. A software-numerical implementation of Miller's algorithm is carried out for different values of the coefficients and the values of the coefficients are obtained, which optimize the error of the accumulated drift. It is shown that for the presented reference model of angular motion, Miller's algorithm with a new set of coefficients provides a lower computational drift error compared to with the classic Miller algorithm and the Ignagni modification, which are optimized for conical motion.

Commodification of accelerations for the Karp and Miller Construction

Karp and Miller’s algorithm is based on an exploration of the reachability tree of a Petri net where, the sequences of transitions with positive incidence are accelerated. The tree nodes of Karp and Miller are labeled with ω-markings representing (potentially infinite) coverability sets. This set of ω-markings allows us to decide several properties of the Petri net, such as whether a marking is coverable or whether the reachability set is finite. The edges of the Karp and Miller tree are labeled by transitions but the associated semantic is unclear which yields to a complex proof of the algorithm correctness. In this work we introduce three concepts: abstraction, acceleration and exploration sequence. In particular, we generalize the definition of transitions to ω-transitions in order to represent accelerations by such transitions. The notion of abstraction makes it possible to greatly simplify the proof of the correctness. On the other hand, for an additional cost in memory, which we theoretically evaluated, we propose an “accelerated” variant of the Karp and Miller algorithm with an expected gain in execution time. Based on a similar idea we have accelerated (and made complete) the minimal coverability graph construction, implemented it in a tool and performed numerous promising benchmarks issued from realistic case studies and from a random generator of Petri nets.

Computing the optimal ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Computing the optimal Ate pairing over elliptic curves with embedding degrees 54 and 48 at the 256-bit security level

Due to recent advances in the computation of finite fields discrete logarithms, the Barreto-Lynn-Scott family of elliptic curves of embedding degree 48 became suitable for instantiating pairing-based cryptography at the 256-bit security level. Observing the uncertainty around determining the constants that govern the best approach for computing discrete logarithms, Scott and Guillevic consider pairing-friendly elliptic curves of embedding degree higher than 50, and discovered a new family of elliptic curves with embedding degree 54. This work aims at investigating the theoretical and practical cost of both the Miller algorithm and the final exponentiation in the computation of the optimal ate pairing on the two aforementioned curves. Both our theoretical results, based on the operation counts of base-field operations, and our experimental observations collected from a real implementation, confirm that BLS48 curves remain the faster curve in the computation of the optimal ate pairing at the 256-bit security level.

Efficient Pairing Computation on Twisted Weierstrass Curves

In this paper, we construct the twists of twisted Edwards curves in Weierstrass form. Then we define a new twisted Ate pairing on twisted Weierstrass curves named the Tx-Ate pairing. Following Miller's algorithm, we give a computation of the Tx-Ate pairing on high degree twisted Weierstrass curves, where the point operations are over Edwards form, and the computation of Miller function is over Weierstrass form. Although, in one doubling loop, our method to compute the Tx-Ate pairing is a litter slower than the previously fastest method. By twists, the Tx-Ate pairing can be calculated on more twisted Weierstrass curves with short loop length. The TxAte pairing is even competitive with optimal Ate pairing when they have the same short loop length.

Improving the computation of the optimal ate pairing for a high security level

Barreto, Lynn and Scott elliptic curves of embedding degree 12 denoted BLS12 have been proven to present the fastest results on the implementation of pairings for the high security levels (Barbulescu and Duquesne in Updating key size estimations for pairings, 2017. http://eprint.iacr.org/2017/334 ). In particular, BLS12 curves may presently be preferable for the 128 bits security level compared to the well known BN curves (Duquesne and Ghammam in Groups Complex Cryptol 8(1):75–90, 2016). The computation of pairings in general involves the execution of the Miller algorithm and the final exponentiation. In this paper, we propose new parameters that allow us to reduce the number of operations in the Miller loop and in the final exponentiation for BLS12 and extend the study to BLS24 curves. This improvement is up to $$8\%$$ , of multiplications in the finite field $$\mathbb {F}_p$$ . Furthermore, as pairings can be implemented on memory constrained devices such as SIM or smart cards (Duquesne and Ghammam in Groups Complex Cryptol 8(1):75–90, 2016), we describe in our work an efficient algorithm for the computation of the final exponentiation which is more efficient and less memory intensive with an improvement up to $$25\%$$ in memory. Our new algorithm can be useful for implementations in a restricted environment.

Many-Core Approaches to Combinatorial Problems: case of the Langford Problem

As observed from the last TOP500 list - November 2015 -, GPUs-accelerated clusters emerge as clear evidence. But exploiting such architectures for combinatorial problem resolution remains a challenge. In this context, this paper focuses on the resolution of an academic combinatorial problem, known as Langford pairing problem, which can be solved using several approaches. We first focus on a general solving scheme based on CSP (Constraint Satisfaction Problem) formalism and backtrack called the Miller algorithm. This method enables us to compute instances up to L(2,21) using both CPU and GPU computational power with load balancing. As dedicated algorithms may still have better computation efficiency we took advantage of the Godfrey algebraic method to solve the Langford problem and implemented it using our multiGPU approach. This allowed us to recompute the last open instances, L(2, 27) and L(2, 28), respectively in less than 2 days and 23 days using best-effort computation on the ROMEO supercomputer with up to 500,000 GPU cores.

Speeding up Pairing Computation Using Non-adjacent Form and ELM Method

The bilinear pairings such as Weil pairing and Tate pairing on elliptic curves have recently found many applications in cryptography. The first efficient algorithm for computing pairing was originally proposed by Miller and much subsequent research has been directed at many different aspects in order to improve efficiency. In 2003, Eisentrager, Lauter and Montgomery proposed a new point-double-addition method to speed up elliptic curve arithmetic computation and obtained a 7.8% performance improvement of the Miller algorithm of a general elliptic curve. In 2006, Blake et al. proposed a new concept based on the conjugate of a line to reduce the total number of lines in the Miller algorithm. In this paper we propose an enhancement of Eisentrager et al.'s algorithm for computing pairings. Our enhancement can further speed up the pairing computation by 5.9%.

Further refinements of Miller’s algorithm on Edwards curves

Recently, Edwards curves have received a lot of attention in the cryptographic community due to their fast scalar multiplication algorithms. Then, many works on the application of these curves to pairing-based cryptography have been introduced. In this paper, we investigate refinements to Miller's algorithm that play a central role in paring computation. We first introduce a variant of Miller function that leads to a more efficient variant of Miller's algorithm on Edwards curves. Then, based on the new Miller function, we present a refinement to Miller's algorithm that significantly improves the performance in comparison with the original Miller's algorithm. Our analyses also show that the proposed refinement is approximately 25 % faster than Xu---Lin's refinements (CT-RSA, 2010). Last but not least, our approach is generic, hence the proposed algorithms allow to compute both Weil and Tate pairings on pairing-friendly Edwards curves of any embedding degree.

Efficient Pairing Computation on Huff Curves

Pairings on elliptic curves are currently of great interest due to their applications in a number of cryptographic protocols such as identity-based encryption, group signatures, short signatures, and the tripartite Diffie-Hellman. Miller's algorithm is the most commonly used method of computing Tate pairing. Denominator elimination can improve Miller's algorithm when the embedding degree has the form 2i3j. However, if the embedding degree does not have the above form, how can the speed of Miller's algorithm be increased? In this article, the authors modified Miller's algorithm over Huff curves. It is about 20.38% faster than the original algorithm.

A survey of fault attacks in pairing based cryptography

The latest implementations of pairings allow efficient schemes for Pairing Based Cryptography. These make the use of pairings suitable for small and constrained devices (smart phones, smart cards?) in addition to more powerful platforms. As for any cryptographic algorithm which may be deployed in insecure locations, these implementations must be secure against physical attacks, and in particular fault attacks. In this paper, we present the state-of-the-art of fault attacks against pairing algorithms, more precisely fault attacks against the Miller algorithm and the final exponentiation which are the two parts of a pairing calculation.

A generalisation of Miller's algorithm and applications to pairing computations on abelian varieties

In this paper, we use the theory of theta functions to generalise to all abelian varieties the usual Miller's algorithm to compute a function associated with a principal divisor. We also explain how to use the Frobenius morphism on abelian varieties defined over a finite field in order to shorten the loop of the Weil and Tate pairings algorithms. This extends preceding results about ate and twisted ate pairings to all abelian varieties. Then building upon the two preceding ingredients, we obtain a variant of optimal pairings on abelian varieties. Finally, by introducing new addition formulas, we explain how to compute optimal pairings on Kummer varieties. We compare in term of performance the resulting algorithms to the algorithms already known in the genus one and two case.

Optimizing the computing of pairing with Miller's algorithm

Optimizing the computing of pairing with Miller's algorithm

Efficient computation of pairings on Jacobi quartic elliptic curves

Abstract This paper proposes the computation of the Tate pairing, Ate pairing and its variations on the special Jacobi quartic elliptic curve Y 2 = d X 4 + Z 4 $Y^{2}=dX^{4}+Z^{4}$ . We improve the doubling and addition steps in Miller's algorithm to compute the Tate pairing. We use the birational equivalence between Jacobi quartic curves and Weierstrass curves, together with a specific point representation to obtain the best result to date among curves with quartic twists. For the doubling and addition steps in Miller's algorithm for the computation of the Tate pairing, we obtain a theoretical gain up to 27 % $27\%$ and 39 % $39\%$ , depending on the embedding degree and the extension field arithmetic, with respect to Weierstrass curves and previous results on Jacobi quartic curves. Furthermore and for the first time, we compute and implement Ate, twisted Ate and optimal pairings on the Jacobi quartic curves. Our results are up to 27 % $27\%$ more efficient compared to the case of Weierstrass curves with quartic twists.

Remarks on the Pocklington and Padró–Sáez cube root algorithm in 𝔽 q

A cube root algorithm in 𝔽q proposed by Pocklington and later rediscovered by Padró and Sáez is clarified and generalised. Some errors in the result of Padró and Sáez are corrected and a full generalisation of their result is given. A comparison of the implementation of the proposed algorithm with the two most popular cube root algorithms is also given, namely the Adleman–Manders–Miller algorithm and the Cipolla–Lehmer algorithm. To the authors’ knowledge, this comparison is the first one which compares three fundamental algorithms together.

Efficient Algorithm for Tate Pairing of Composite Order

Boneh et al. proposed the new idea of pairing-based cryptography by using the composite order group instead of prime order group. Recently, many cryptographic schemes using pairings of composite order group were proposed. Miller's algorithm is used to compute pairings, and the time of computing the pairings depends on the cost of calculating the Miller loop. As a method of speeding up calculations of the pairings of prime order, the number of iterations of the Miller loop can be reduced by choosing a prime order of low Hamming weight. However, it is difficult to choose a particular composite order that can speed up the pairings of composite order. Kobayashi et al. proposed an efficient algorithm for computing Miller's algorithm by using a window method, called Window Miller's algorithm. We can compute scalar multiplication of points on elliptic curves by using a window hybrid binary-ternary form (w-HBTF). In this paper, we propose a Miller's algorithm that uses w-HBTF to compute Tate pairing efficiently. This algorithm needs a precomputation both of the points on an elliptic curve and rational functions. The proposed algorithm was implemented in Java on a PC and compared with Window Miller's Algorithm in terms of the time and memory needed to make their precomputed tables. We used the supersingular elliptic curve y2=x3+x with embedding degree 2 and a composite order of size of 2048-bit. We denote w as window width. The proposed algorithm with w=6=2·3 was about 12.9% faster than Window Miller's Algorithm with w=2 although the memory size of these algorithms is the same. Moreover, the proposed algorithm with w=162=2·34 was about 12.2% faster than Window Miller's algorithm with w=7.

New formulae for Tate pairing computation on Weierstrass curves

This paper proposes a variation of Miller's algorithm for Tate pairing computation on Weierstrass curves. Unlike the original Miller's algorithm which consists of two major operations: the doubling operation and the addition operation, this new algorithm replaces the addition with a doubling-addition (DA) operation to take the advantage of the fast point doubling-addition formula. Explicit formulae are given for the new algorithm. We suggest to use the new formulae for Weierstrass curves with general parameters for Tate pairing to gain a better performance.

이동 Ad-Hoc 네트워크 환경에서 페어링 연산의 밀러 알고리듬에 대한 데이터 오류 공격

최근 이동 ad hoc 네트워크에 적합한 ID 기반의 암호시스템 구현을 위해서 다양한 페어링 연산들이 사용되고 있으며, 밀러 알고리듬은 Weil, Tate, Ate 페어링 연산에서 가장 많이 사용되는 알고리듬이다. 본 논문에서는 Whelan과 Scott에 의해 제안된 밀러 알고리듬의 중간 값에 대한 오류 공격을 구체화하여 라운드 위치와 상관없이 적용할 수 있는 데이터 오류 주입 공격의 가능성을 분석하였다. 시뮬레이션 결과, 제안하는 공격 방법이 라운드 위치나 사용하는 좌표계와 관계없이 적용 가능하여 효과적이며 강력한 오류 주입 공격 방법임을 확인하였다.