Elliptic Curve Public Key Cryptosystems
Elliptic Curve Public Key Cryptosystems
Efficient Algorithms for Pairing-Based Cryptosystems
CRYPTO '02 Proceedings of the 22nd Annual International Cryptology Conference on Advances in Cryptology
The Weil Pairing, and Its Efficient Calculation
Journal of Cryptology
Efficient pairing computation on supersingular Abelian varieties
Designs, Codes and Cryptography
Pairing '08 Proceedings of the 2nd international conference on Pairing-Based Cryptography
Constructing Brezing-Weng Pairing-Friendly Elliptic Curves Using Elements in the Cyclotomic Field
Pairing '08 Proceedings of the 2nd international conference on Pairing-Based Cryptography
Endomorphisms for Faster Elliptic Curve Cryptography on a Large Class of Curves
EUROCRYPT '09 Proceedings of the 28th Annual International Conference on Advances in Cryptology: the Theory and Applications of Cryptographic Techniques
On the Final Exponentiation for Calculating Pairings on Ordinary Elliptic Curves
Pairing '09 Proceedings of the 3rd International Conference Palo Alto on Pairing-Based Cryptography
Fast Hashing to G2 on Pairing-Friendly Curves
Pairing '09 Proceedings of the 3rd International Conference Palo Alto on Pairing-Based Cryptography
Efficient and generalized pairing computation on Abelian varieties
IEEE Transactions on Information Theory
A Taxonomy of Pairing-Friendly Elliptic Curves
Journal of Cryptology
IEEE Transactions on Information Theory
High-speed software implementation of the optimal ate pairing over Barreto-Naehrig curves
Pairing'10 Proceedings of the 4th international conference on Pairing-based cryptography
A family of implementation-friendly BN elliptic curves
Journal of Systems and Software
Faster explicit formulas for computing pairings over ordinary curves
EUROCRYPT'11 Proceedings of the 30th Annual international conference on Theory and applications of cryptographic techniques: advances in cryptology
Constructing pairing-friendly elliptic curves with embedding degree 10
ANTS'06 Proceedings of the 7th international conference on Algorithmic Number Theory
Faster squaring in the cyclotomic subgroup of sixth degree extensions
PKC'10 Proceedings of the 13th international conference on Practice and Theory in Public Key Cryptography
Pairing-Based cryptography at high security levels
IMA'05 Proceedings of the 10th international conference on Cryptography and Coding
Pairing-Friendly elliptic curves of prime order
SAC'05 Proceedings of the 12th international conference on Selected Areas in Cryptography
IEEE Transactions on Information Theory
Implementing cryptographic pairings over barreto-naehrig curves
Pairing'07 Proceedings of the First international conference on Pairing-Based Cryptography
Implementing pairings at the 192-bit security level
Pairing'12 Proceedings of the 5th international conference on Pairing-Based Cryptography
NEON implementation of an attribute-based encryption scheme
ACNS'13 Proceedings of the 11th international conference on Applied Cryptography and Network Security
Hi-index | 0.00 |
An asymmetric pairing $e\colon{\mathbb{G}}_2\times{\mathbb{G}}_1\to{\mathbb{G}}_T$ is considered such that ${\mathbb{G}}_1=E({\mathbb F}_p)[r]$ and ${\mathbb{G}}_2=\tilde E({\mathbb F}_{p^{k/d}})[r]$ , where k is the embedding degree of the elliptic curve $E/{\mathbb F}_p$ , r is a large prime divisor of $\# E({\mathbb F}_p)$ , and $\tilde E$ is the degree-d twist of E over ${\mathbb F}_{p^{k/d}}$ with $r \mid \tilde E ({\mathbb F}_{p^{k/d}} )$ . Hashing to ${\mathbb{G}}_1$ is considered easy, while hashing to ${\mathbb{G}}_2$ is done by selecting a random point Q in $\tilde E({\mathbb F}_{p^{k/d}})$ and computing the hash value cQ, where c·r is the order of $\tilde E({\mathbb F}_{p^{k/d}})$ . We show that for a large class of curves, one can hash to ${\mathbb{G}}_2$ in $\textup{O}(1/\varphi (k)\log c)$ time, as compared with the previously fastest-known $\textup{O}(\log p)$ . In the case of BN curves, we are able to double the speed of hashing to ${\mathbb{G}}_2$ . For higher-embedding-degree curves, the results can be more dramatic. We also show how to reduce the cost of the final-exponentiation step in a pairing calculation by a fixed number of field multiplications.