Miller's Algorithm Research Articles

Minimal Coverability Set for Petri Nets: Karp and Miller Algorithm with Pruning

This paper presents the Monotone-Pruning algorithm (MP) for computing the minimal coverability set of Petri nets. The original Karp and Miller algorithm (K&M) unfolds the reachability graph of a Petri net and uses acceleration on branches to ensure termination. The MP algorithm improves the K&M algorithm by adding pruning between branches of the K&M tree. This idea was first introduced in the Minimal Coverability Tree algorithm (MCT), however it was recently shown to be incomplete. The MP algorithm can be viewed as the MCT algorithm with a slightly more aggressive pruning strategy which ensures completeness. Experimental results show that this algorithm is a strong improvement over the K&M algorithm.

A method for efficient parallel computation of Tate pairing

The calculation of pairing plays a key role in pairing-based cryptography. Usually, the calculation is based on Miller's algorithm. However, most of the optimisations of Miller's algorithm are of serial structure. In this paper, we propose a method to parallel compute Tate pairing efficiently. We split the divisor in Miller's algorithm into three parts. Then we use efficiently computation endomorphism and precomputation method to reduce computational cost. Compared with general version of Miller's algorithm in serial structure, our method has a gain of around 50.0%.

Refinements of Miller's Algorithm over Weierstrass Curves Revisited

In 1986, Victor Miller described an algorithm for computing the Weil pairing in his unpublished manuscript. This algorithm has then become the core of all pairing-based cryptosystems. Many improvements of the algorithm have been presented. Most of them involve a choice of elliptic curves of a special form to exploit a possible twist during Tate pairing computation. Other improvements involve a reduction of the number of iterations in the Miller's algorithm. For the generic case, Blake, Murty and Xu proposed three refinements to Miller's algorithm over Weierstrass curves. Though their refinements, which only reduce the total number of vertical lines in Miller's algorithm, did not give an efficient computation as other optimizations, they can be applied for computing both Weil and Tate pairings on all pairing-friendly elliptic curves. In this paper, we extend the Blake–Murty–Xu's method and show how to perform an elimination of all vertical lines in Miller's algorithm during computation of Weil/Tate pairings, on general elliptic curves. Experimental results show that our algorithm is faster by ~25% in comparison with the original Miller's algorithm.

MATLAB GUI for computing Bessel functions using continued fractions algorithm

Higher order Bessel functions are prevalent in physics and engineering and there exist different methods to evaluate them quickly and efficiently. Two of these methods are Miller's algorithm and the continued fractions algorithm. Miller's algorithm uses arbitrary starting values and normalization constants to evaluate Bessel functions. The continued fractions algorithm directly computes each value, keeping the error as small as possible. Both methods respect the stability of the Bessel function recurrence relations. Here we outline both methods and explain why the continued fractions algorithm is more efficient. The goal of this paper is both (1) to introduce the continued fractions algorithm to physics and engineering students and (2) to present a MATLAB GUI (Graphic User Interface) where this method has been used for computing the Semi-integer Bessel Functions and their zeros.

Implementation And Optimization For Tate Pairing

Abstract Tate pairings has found several new applications in cryptography. However, how to compute Tate pairing is a research focus in all kinds of applications of pairing-based cryptosysterns (PBC). In the paper, the structure of Miller's algorithm is firstly analyzed, which is used to implement Tate pairing. Based on the characteristics that Miller's algorithm will be improved tremendous if the order of the subgroup of elliptic curve group is low hamming prime, a method of generating primes with low hamming is presented. Then, a new method for generating parameters for PBC is put forward, which enable it feasible that there is certain some subgroup of low hamming prime order in the elliptic curve group generated. Moreover, an optimization implementation of Miller's algorithm for computing Tate pairing is given. Finally, the computation efficiency of Tate pairing using the new parameters for PBC is analyzed, which saves 25.4% of the time to compute the Tate pairing.

An Improvement of Twisted Ate Pairing Efficient for Multi-Pairing and Thread Computing

In the case of Barreto-Naehrig pairing-friendly curves of embedding degree 12 of order r, recent efficient Ate pairings such as R-ate, optimal, and Xate pairings achieve Miller loop lengths of (1/4)⌊log2r⌋. On the other hand, the twisted Ate pairing requires (3/4)⌊log2r⌋ loop iterations, and thus is usually slower than the recent efficient Ate pairings. This paper proposes an improved twisted Ate pairing using Frobenius maps and a small scalar multiplication. The proposed idea splits the Miller's algorithm calculation into several independent parts, for which multi-pairing techniques apply efficiently. The maximum number of loop iterations in Miller's algorithm for the proposed twisted Ate pairing is equal to the (1/4)⌊log2r⌋ attained by the most efficient Ate pairings.

A Simplifying Method of Fault Attacks on Pairing Computations

This paper presents a simplifying method of the two previous fault attacks to pairing and the Miller algorithms based on a practical fault assumption. Our experimental result shows that the assumption is feasible and easy to implement.

Two Improvements of Twisted Ate Pairing with Barreto-Naehrig Curve by Dividing Miller's Algorithm

This paper shows two improvements of twisted-Ate pairing with Barreto-Naehrig curve so as to be efficiently carried out by dividing the calculation loops of Miller's algorithm based on divisor theorem. Then, this paper shows some experimental results from which it is shown that each improvements accelerate twisted-Ate pairing.

Fast Architectures for the \eta_T Pairing over Small-Characteristic Supersingular Elliptic Curves

This paper is devoted to the design of fast parallel accelerators for the cryptographic ηT pairing on supersingular elliptic curves over finite fields of characteristics two and three. We propose here a novel hardware implementation of Miller's algorithm based on a parallel pipelined Karatsuba multiplier. After a short description of the strategies that we considered to design our multiplier, we point out the intrinsic parallelism of Miller's loop and outline the architecture of coprocessors for the ηT pairing over F(2m) and F(2m). Thanks to a careful choice of algorithms for the tower field arithmetic associated with the ηT pairing, we manage to keep the pipelined multiplier at the heart of each coprocessor busy. A final exponentiation is still required to obtain a unique value, which is desirable in most cryptographic protocols. We supplement our pairing accelerators with a coprocessor responsible for this task. An improved exponentiation algorithm allows us to save hardware resources. According to our place-and-route results on Xilinx FPGAs, our designs improve both the computation time and the area-time trade-off compared to previously published coprocessors.

A new Fortran 90 program to compute regular and irregular associated Legendre functions

We present a modern Fortran 90 code to compute the regular P l m ( x ) and irregular Q l m ( x ) associated Legendre functions for all x ∈ ( − 1 , + 1 ) (on the cut) and | x | > 1 and integer degree ( l) and order ( m). The code applies either forward or backward recursion in ( l) and ( m) in the stable direction, starting with analytically known values for forward recursion and considering both a Wronskian based and a modified Miller's method for backward recursion. While some Fortran 77 codes existed for computing the functions off the cut, no Fortran 90 code was available for accurately computing the functions for all real values of x different from x = ± 1 where the irregular functions are not defined. Program summary Program title: Associated Legendre Functions Catalogue identifier: AEHE_v1_0 Program summary URL: http://cpc.cs.qub.ac.uk/summaries/AEHE_v1_0.html Program obtainable from: CPC Program Library, Queen's University, Belfast, N. Ireland Licensing provisions: Standard CPC licence, http://cpc.cs.qub.ac.uk/licence/licence.html No. of lines in distributed program, including test data, etc.: 6722 No. of bytes in distributed program, including test data, etc.: 310 210 Distribution format: tar.gz Programming language: Fortran 90 Computer: Linux systems Operating system: Linux RAM: bytes Classification: 4.7 Nature of problem: Compute the regular and irregular associated Legendre functions for integer values of the degree and order and for all real arguments. The computation of the interaction of two electrons, 1 / | r 1 − r 2 | , in prolate spheroidal coordinates is used as one example where these functions are required for all values of the argument and we are able to easily compare the series expansion in associated Legendre functions and the exact value. Solution method: The code evaluates the regular and irregular associated Legendre functions using forward recursion when | x | < 1 starting the recursion with the analytically known values of the first two members of the sequence. For values of the argument | x | < 1 , the upward recursion over the degree for the regular functions is numerically stable. For the irregular functions, backward recursion must be applied and a suitable method of starting the recursion is required. The program has two options; a modified version of Miller's algorithm and the use of the Wronskian relation between the regular and irregular functions, which was the method considered in [1]. Both approaches require the computation of a continued fraction to begin the recursion. The Wronskian method (which can also be described as a modified Miller's method) is a convenient method of computations when both the regular and irregular functions are needed. Running time: The example tests provided take a few seconds to run.

Faster computation of the Tate pairing

Text This paper proposes new explicit formulas for the doubling and addition steps in Miller's algorithm to compute the Tate pairing on elliptic curves in Weierstrass and in Edwards form. For Edwards curves the formulas come from a new way of seeing the arithmetic. We state the first geometric interpretation of the group law on Edwards curves by presenting the functions which arise in addition and doubling. The Tate pairing on Edwards curves can be computed by using these functions in Miller's algorithm. Computing the sum of two points or the double of a point and the coefficients of the corresponding functions is faster with our formulas than with all previously proposed formulas for pairings on Edwards curves. They are even competitive with all published formulas for pairing computation on Weierstrass curves. We also improve the formulas for Tate pairing computation on Weierstrass curves in Jacobian coordinates. Finally, we present several examples of pairing-friendly Edwards curves. Video For a video summary of this paper, please click here or visit http://www.youtube.com/watch?v=nideQo-K9ME/.

Efficient and Generalized Pairing Computation on Abelian Varieties

In this paper, we propose a new method for constructing a bilinear pairing over (hyper)elliptic curves, which we call the R-ate pairing. This pairing is a generalization of the Ate and Atei pairing, and can be computed more efficiently. Using the R-ate pairing, the loop length in Miller's algorithm can be as small as log (r1/phi(k)) some pairing-friendly elliptic curves which have not reached this lower bound. Therefore, we obtain savings of between 29% and 69% in overall costs compared to the Atei pairing. On supersingular hyperelliptic curves of genus 2, we show that this approach makes the loop length in Miller's algorithm shorter than that of the Ate pairing.

Fast Ate Pairing Computation of Embedding Degree 12 Using Subfield-Twisted Elliptic Curve

This paper presents implementation techniques of fast Ate pairing of embedding degree 12. In this case, we have no trouble in finding a prime order pairing friendly curve E such as the Barreto-Naehrig curve $y^2=x^3+a, a\\in\\Fp{}$. For the curve, an isomorphic substitution from $\\Gii\\subset \\EFpxii$ into $\\Gii'$ in subfield-twisted elliptic curve $\\EdFpii$ speeds up scalar multiplications over $\\Gii$ and wipes out denominator calculations in Miller's algorithm. This paper mainly provides about 30% improvement of the Miller's algorithm calculation using proper subfield arithmetic operations. Moreover, we also provide the efficient parameter settings of the BN curves. When p is a 254-bit prime, the embedding degree is 12, and the processor is Pentium4 (3.6GHz), it is shown that the proposed algorithm computes Ate pairing in 13.3 milli-seconds including final exponentiation.

Integer Variable .CHI.-Based Cross Twisted Ate Pairing and Its Optimization for Barreto-Naehrig Curve

It is said that the lower bound of the number of iterations of Miller's algorithm for pairing calculation is log2 r/φ(k), where φ(·) is the Euler's function, r is the group order, and k is the embedding degree. Ate pairing reduced the number of the loops of Miller's algorithm of Tate pairing from ⌊log2 r⌋ to ⌊ log2(t-1)⌋, where t is the Frobenius trace. Recently, it is known to systematically prepare a pairing-friendly elliptic curve whose parameters are given by a polynomial of integer variable “χ.” For such a curve, this paper gives integer variable χ-based Ate (Xate) pairing that achieves the lower bound. In the case of the well-known Barreto-Naehrig pairing-friendly curve, it reduces the number of loops to ⌊log2χ⌋. Then, this paper optimizes Xate pairing for Barreto-Naehrig curve and shows its efficiency based on some simulation results.

Algorithm 877

The algorithm presented provides a package of subroutines for calculating the cylindrical functions J ν ( x ), N ν ( x ), H ν (1) ( x ), H ν (2) ( x ) where the order ν is complex and the real argument x is nonnegative. The algorithm is written in Fortran 95 and calculates the functions using single, double, or quadruple precision according to the value of a parameter defined in the algorithm. The methods of calculating the functions are based on a series expansion, Debye's asymptotic expansions, Olver's asymptotic expansions, and recurrence methods (Miller's algorithms). The relative errors of the functional values computed by this algorithm using double precision are less than 2.4×10 − 13 in the region 0 ≤ Re ν ≤ 64, 0 ≤ Im ν ≤ 63, 0.024 ≤ x ≤ 97.

Closed formulae for the Weil pairing inversion

Using the Miller algorithm, we can efficiently compute the Weil pairing for two given points on an elliptic curve. On the other hand, security of pairing based cryptographic protocols depends on the converse problem: find a point on an elliptic curve whose Weil pairing with a given (fixed) point is equal to a given root of unity, which we call the Weil pairing inversion problem. In this article, we give closed formulae which give a solution to the problem. For supersingular elliptic curves over fields of characteristic two or three, these formulae take more simpler forms than those for other elliptic curves.

Refinements of Miller's algorithm for computing the Weil/Tate pairing

The efficient computation of the Weil and Tate pairings is of significant interest in the implementation of certain recently developed cryptographic protocols. The standard method of such computations has been the Miller algorithm. Three refinements to Miller's algorithm are given in this work. The first refinement is an overall improvement. If the binary expansion of the involved integer has relatively high Hamming weight, the second improvement suggested shows significant gains. The third improvement is especially efficient when the underlying elliptic curve is over a finite field of characteristic three, which is a case of particular cryptographic interest. Comment on the performance analysis and characteristics of the refinements are given.

Algorithm of asynchronous binary signed-digit recoding on fast multiexponentiation

Multiexponentiation, for the 2-dimension one especially, is a very important but time-consuming operation in many ElGamal-like public key cryptosystems. An efficient multiexponentiation method is firstly proposed by Shamir in ElGamal’s paper. Shamir’s method requires 1.75 n modular multiplications in average, where n is the bit-length of the exponents. Using minimal weight binary signed-digit (BSD) representations in Shamir’s method can reduce the number of multiplications to 1.556 n. Due to there are many minimal weight BSD representations for an integer, Dimitrov et al. proposed a new 2-dimension multiexponentiation algorithm to recode the canonical binary signed-digit representations. The average number of the number 1.556 n is reduced to 1.534 n. After the publish of the Dimitrov–Jullien–Miller algorithm, there are many research on receding BSD representation of a pair of integers. The most interesting one is the joint sparse form. The number of multiplication can be reduced to 1.500 n in joint sparse form when the exponent length is near infinite. In this paper, we propose a new asynchronous recoding algorithm to reduce the factor to 1.509n. For comparison to all the previous algorithm, the property of asynchronous receding is especially suitable for multi-dimension multiexponentiation.

Unification with extended patterns

An extension of Miller's algorithm for β 0-unification of typed λ-terms is presented. The extension considered is the addition of products and polymorphism to β 0-unification; the new unification problem is termed β 0 π-unification. Miller's pattern restriction is generalized by allowing repeated occurrences of variables to appear as arguments to free function variables, provided such variables are prefixed by distinct sequences of projections. This extended pattern restriction has several applications, including the definition of higher-order explicit substitutions. The algorithm is verified to terminate, and is shown to be sound and complete.

A routine to compute the energy and wave function forone-electron two-nuclei molecular systems

The routine presented computes the molecular energy and wave function of one-electron two-hydrogen like nuclei systemswithin the adiabatic approximation. For particular forms of the electron-nucleus potential, also one-active electron systems may be considered. The method used is the one developed by Killingbeck associated with Miller's algorithm.