An Improvement of Twisted Ate Pairing with Barreto-Naehrig Curve by using Frobenius Mapping

This paper proposes an improvement of twisted-Ate pairing with Barreto-Naehrig curve so as to efficiently use Frobenius mapping with respect to prime field. Then, this paper shows some simulation results by which it is shown that the improvement accelerates twisted-Ate pairing.

it corresponds to the number of iterations of Miller's algorithm. In addition, the hamming weight of ( t -1 ) 2 mod r is preferred to be small for Miller's algorithm to be fast carried out. This paper proposes an improvement of Miller's algorithm.
In the improvement, we use the following relations:  (Bailey & Paar, 1998). After that, the authors show some simulation results from which we find that the improvement shown in this paper efficiently accelerates twisted-Ate pairing including final exponentiation about 14.1%. Throughout this paper, p and k denote characteristic and extension degree, respectively. k p F denotes k-th extension field over p F and * k p F denotes its multiplicative group.

Fundamantals
This section briefly reviews elliptic curve, twisted-Ate pairing, and divisor theorem. . The smallest positive integer k such that r divides p k -1 is especially called embedding degree. One can consider a pairing such as Tate and Ate pairings on

Elliptic curve and BN curve
where t is the Frobenius trace of ) ( p F E . Characteristic p and Frobenius trace t of Barreto--Naehrig (BN) curve (Barreto & Naehrig, 2005) are given by using an integer variable χ as Eqs.
(1). In addition, BN curve E is written as (5) whose embedding degree is 12. In this paper, let ) ( # p F E be a prime number r for instance.

Twisted ate pairing with BN curve
Let φ be Frobenius endomorphism, i.e., Then, in the case of BN curve, let 1 G and 2 G be where 6 ξ is a primitive 6-th root of unity and let An Improvement of Twisted Ate Pairing with Barreto-Naehrig Curve by using Frobenius Mapping is usually calculated by Miller's algorithm (Devegili et al., 2007), then so--called final exponentiation , where s is, in this case, given by It is said that calculation cost of Miller's Algorithm is about twice of that of final exponentiation.

Divisor
Let D be the principal divisor of E Q ∈ given as , let aD and bD be written as where Q a f , and Q b f , are the rational functions for aD and bD, respectively. Then, addition for divisors is given as . Moreover, the following relation holds.
Thus, let (a+b)D and (ab)D be written as we have the following relation. , Miller's algorithm calculates Q s f , efficiently.

Introduction of Miller's algorithm
The proposed method has the following advantages. • χ of small hamming weight efficiently works.

•
It can reduce a multiplication in 12 p F at Step6 of Algorithm 3 by Frobenius mapping. Input:

5.
: Algorithm 3. Miller's Algorithm whose initial value of f is ' f .

Experimental result
In order to show the efficiency of the proposed method, the authors simulated twisted-Ate pairing with BN curve of order 254 2 ≈ r . In this simulation, the authors used χ and BN curve shown in Table 3. Table 4 shows the simulation result. As a reference,

Conclusion
This paper has proposed an improvement of twisted-Ate pairing with Barreto-Naehrig curve so as to efficiently use Frobenius mapping with respect to prime field. Then, this paper showed some simulation result by which it was shown that the improvement accelerated twisted-Ate pairing including final exponentiation about 14.1%.