A Coprocessor for the Final Exponentiation of the ηTPairing in Characteristic Three

  • Authors:

  • Jean-Luc Beuchat;Nicolas Brisebarre;Masaaki Shirase;Tsuyoshi Takagi;Eiji Okamoto

  • Affiliations:

  • Laboratory of Cryptography and Information Security, University of Tsukuba, 1-1-1 Tennodai, Tsukuba, Ibaraki, 305-8573, Japan;LaMUSE, Université J. Monnet, 23, rue du Dr P. Michelon, F-42023 Saint-Étienne Cedex 02, France and LIP/Arénaire (CNRS-ENS Lyon-INRIA-UCBL), ENS Lyon, 46 Allée d'Italie, F-6936 ...;Future University-Hakodate, School of Systems Information Science, 116-2 Kamedanakano-cho, Hakodate, Hokkaido, 041-8655, Japan;Future University-Hakodate, School of Systems Information Science, 116-2 Kamedanakano-cho, Hakodate, Hokkaido, 041-8655, Japan;Laboratory of Cryptography and Information Security, University of Tsukuba, 1-1-1 Tennodai, Tsukuba, Ibaraki, 305-8573, Japan

  • Venue:
  • WAIFI '07 Proceedings of the 1st international workshop on Arithmetic of Finite Fields
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Since the introduction of pairings over (hyper)elliptic curves in constructive cryptographic applications, an ever increasing number of protocols based on pairings have appeared in the literature. Software implementations being rather slow, the study of hardware architectures became an active research area. Beuchat et al.proposed for instance a coprocessor which computes the characteristic three 茂戮驴Tpairing, from which the Tate pairing can easily be derived, in 33 μs on a Cyclone II FPGA. However, a final exponentiation is required to ensure a unique output value and the authors proposed to supplement their 茂戮驴Tpairing accelerator with a coprocessor for exponentiation. Thus, the challenge consists in designing the smallest possible piece of hardware able to perform this task in less than 33 μs on a Cyclone II device. In this paper, we propose a novel arithmetic operator implementing addition, cubing, and multiplication over $\mathbb{F}_{3^{97}}$ and show that a coprocessor based on a single such operator meets this timing constraint.