A variant of Miller's formula and algorithm

17Citations
Citations of this article
21Readers
Mendeley users who have this article in their library.
Get full text

Abstract

Miller's algorithm is at the heart of all pairing-based cryptosystems since it is used in the computation of pairing such as that of Weil or Tate and their variants. Most of the optimizations of this algorithm involve elliptic curves of particular forms, or curves with even embedding degree, or having an equation of a special form. Other improvements involve a reduction of the number of iterations. In this article, we propose a variant of Miller's formula which gives rise to a generically faster algorithm for any pairing friendly curve. Concretely, it provides an improvement in cases little studied until now, in particular when denominator elimination is not available. It allows for instance the use of elliptic curve with embedding degree not of the form 2i 3j, and is suitable for the computation of optimal pairings. We also present a version with denominator elimination for even embedding degree. In our implementations, our variant saves between 10% and 40% in running time in comparison with the usual version of Miller's algorithm without any optimization. © 2010 Springer-Verlag Berlin Heidelberg.

Cite

CITATION STYLE

APA

Boxall, J., El Mrabet, N., Laguillaumie, F., & Le, D. P. (2010). A variant of Miller’s formula and algorithm. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 6487 LNCS, pp. 417–434). https://doi.org/10.1007/978-3-642-17455-1_26

Register to see more suggestions

Mendeley helps you to discover research relevant for your work.

Already have an account?

Save time finding and organizing research with Mendeley

Sign up for free