Search

Nowadays, pairing-based cryptography researchers are looking for new parameters for standard security levels against the new number field sieve tower number field sieve algorithm. Recently, they have suggested new parameters for well-studied pairing-friendly curves with odd embedding degrees five and seven resistant to this attack. In this paper, we define optimal ate pairing on curves using sparse families with embedding degrees five and seven. We also provide details to perform the miller loop and the final exponentiation using addition chain process. Our theoretical results costs indicate that these families of curves offer the best performance in the computation of the optimal ate pairing at the 128-bit security level compared to Cocks–Pinch curves of embedding degrees five and seven. The improvement is about 8 , 8 % and 1 9 % faster than the optimal ate pairing previously computed on Cocks–Pinch curves of embedding degrees five and seven, respectively. [ABSTRACT FROM AUTHOR]

Elliptic curves are typically defined by Weierstrass equations. Given a kernel, the well-known Vélu's formula shows how to explicitly write down an isogeny between Weierstrass curves. However, it is not clear how to do the same on other forms of elliptic curves without isomorphisms mapping to and from the Weierstrass form. Previous papers have shown some isogeny formulas for (twisted) Edwards, Huff, and Montgomery forms of elliptic curves. Continuing this line of work, this paper derives explicit formulas for isogenies between elliptic curves in (twisted) Hessian form. In addition, we examine the numbers of operations in the base field to compute the formulas. In comparison with other isogeny formulas, we note that our formulas for twisted Hessian curves have the lowest costs for processing the kernel and our X-affine formula has the lowest cost for processing an input point in affine coordinates.

We propose in this work a Sieve algorithm that we called OrthogonalInteger sieve algorithm for some orthogonal integer lattices and particularly the case of integer lattices Λ ⊂ ℤ n , root lattices of type A n (n ≥ 1) and of type D n (n ≥ 2). In these cases, we use the famous L L L algorithm to find the shortest vector of these lattices. Indeed, in general, a sieve algorithm builds a list of short random vectors which are not necessarily in the lattice, and try to produce short lattice vectors by taking linear combinations of the vectors in the list. But in our case, we built a list of short vectors in the lattice. From the first column of the L L L -reduced basis of the considered basis, we have the list of at least n and at most 2 n short vectors for the general case (where n is the dimension of the lattice) of orthogonal integer lattices Λ ⊂ ℤ n . For the lattices ℤ n , A n (n ≥ 1) and D n (n ≥ 2), we have, respectively, 2 n , n (n + 1) and 2 n (n − 1) short vectors. The proposed sieve algorithm for integer lattice ℤ n runs in space O (2 n) and the OrthogonalInteger sieve algorithm performs O (n 2 n) arithmetic operations and is polynomial in space. [ABSTRACT FROM AUTHOR]

This paper proposes the computation of the Tate pairing, Ate pairing and its variations on the special Jacobi quartic elliptic curve Y2=dX4+Z4$Y^{2}=dX^{4}+Z^{4}$. We improve the doubling and addition steps in Miller's algorithm to compute the Tate pairing. We use the birational equivalence between Jacobi quartic curves and Weierstrass curves, together with a specific point representation to obtain the best result to date among curves with quartic twists. For the doubling and addition steps in Miller's algorithm for the computation of the Tate pairing, we obtain a theoretical gain up to 27%$27\%$ and 39%$39\%$, depending on the embedding degree and the extension field arithmetic, with respect to Weierstrass curves and previous results on Jacobi quartic curves. Furthermore and for the first time, we compute and implement Ate, twisted Ate and optimal pairings on the Jacobi quartic curves. Our results are up to 27%$27\%$ more efficient compared to the case of Weierstrass curves with quartic twists.

In this work, we use division polynomials on Edwards elliptic curves to construct elliptic nets of rank one called elliptic divisibility sequence on this curve. Introduced by Morgan Ward, elliptic divisibility sequence on elliptic curve are used for solving the elliptic curve discrete logarithm problem (ECDLP). Moved on rank 2, Elliptic Nets algorithm via elliptic nets associated to Weierstrass elliptic curves are useful for the computation of bilinear maps (called pairings) defined on the groups of points of elliptic curves and very useful to the construction of cryptographic protocols. [ABSTRACT FROM AUTHOR]

The choice of the elliptic curve for a given pairing based protocol is primordial. For many cryptosystems based on pairings such as group signatures and their variants (EPID, anonymous attestation, etc) or accumulators, operations in the first pairing group G\documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$\mathbb {G}$$\end{document} of points of the elliptic curve is more predominant. At 128-bit security level two curves BW13-P310 and BW19-P286 with odd embedding degrees 13 and 19 suitable for super optimal pairing have been recommended for such pairing based protocols. But a prime embedding degree (k=13;19\documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$k=13;19$$\end{document}) eliminates some important optimisation for the pairing computation. However The Miller loop length of the superoptimal pairing is the half of that of the optimal ate pairing but involve more exponentiations that affect its efficiency. In this work, we successfully develop methods and construct algorithms to efficiently evaluate and avoid heavy exponentiations that affect the efficiency of the superoptimal pairing. This leads to the definition of new bilinear and non degenerate pairing on BW13-P310 and BW19-P286 called x-superoptimal pairing where its Miller loop is about 15.3%\documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$15.3 \%$$\end{document} and 39.8%\documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$39.8 \%$$\end{document} faster than the one of the optimal ate pairing previously computed on BW13-P310 and BW19-P286 respectively. [ABSTRACT FROM AUTHOR]