Efficient and Generalized Pairing Computation on Abelian Varieties

50 Pages·2008·0.62 MB·English

ECC 2008
Efficient and Generalized Pairing
Computation on Abelian Varieties
Hyang-Sook Lee
Ewha Womans University
Korea
Joint Work with
Eunjeong Lee (North Carolina State University)
Cheol-Min Park (EWHA)
2008. 9. 22
Contents
Background of pairings

Efficient pairing computations - “review”

Motivation for efficient pairing computation

Eta and Eta pairings on supersingular curves
 T
Ate and Ate pairings on ordinary curves
 i
R-ate pairing

Optimal pairing

Background of Pairings
Pairings
(G ,+), (G ,+) and (G ,*) : cyclic groups of a prime order r
1 2 3
e be a map e : G X G → G satisfying
1 2 3
► Non-degeneracy : If e(P, Q) = 1 for all Q ∈ G ,
2
then P ∈ G is the identity (vice versa)
1
► Bilinearity : e(aP, bP) = e(P, P)ab for a, b ∈ Z
► e is computable in polynomial time
⇒ e : bilinear map or pairing
(ex) Weil and Tate pairings on supersingular curves using distortion
map.
Tate pairing/Ate pairing
F : finite field with q elements
q
C : nonsingular curve of genus g over F
q
J : a group of degree zero divisor classes of C
C
g = 1 ⇒ J elliptic curve
C
r : a positive divisor of |J (F )| with gcd(r, q) = 1
C q
k is the smallest integer s.t. if r|qk -1, r ł qs -1, 0< s < k
⇒ k: embedding degree
J [r] : divisor classes of order dividing r
C
Tate pairing
Define the Tate pairing
* * r
< , > : J [r] X J (F )/rJ (F ) → F / (F ) by
k k k k
C C q C q q q
<D, E> = f (E’)
r,D
where div(f ) = rD, E’∼E with supp(E’)∩ supp(div(f )) = Φ.
r,D r,D
For the uniqueness in F , define the reduced Tate pairing
k
q
k
e(D, E) = f (E’)(q – 1)/r
r,D
Ate pairing
Let φ be the q-power Frobenius endomorphism on J .
C
G = J [r] ∩ ker(φ – 1), G = J [r] ∩ ker(φ – [q]).
1 c 2 c
For D  G , E  G ,
1 2
k
Ate pairing (g=1)[HSV] : a(E, D) = f (D)(q – 1)/r
t-1,E
k
Ate pairing (g≥2)[GHOTV] : a(E, D) = f (D)(q – 1)/r
q,E
k
Ate pairing (g=1)[ZZH] : a (E, D) = f (D)(q – 1)/r , 0<i< k
i
i i q mod r,E
Miller’s Algorithm
Input : r=∑n-1 r 2i Z, DJ [r], EJ (F )/rJ (F )
k k
i=0 i C C q C q
Output : e(D,E)
V=D, f=1
Number of
For i=n-1 down to 0
iterations
f ← f2·g (E)/g (E) V ← 2V
Def.
V,V 2V
Miller length
If r =1 then
i
n = log r
2 f ← f2·g (E)/g (E) V ← V+D
V,D V+D
k
Return f(q -1)/r
Miller’s Algorithm
div(f ) = n(P) - n(O)
 n
div(f ) = 2(P) - (2P) - (O)
 2 (f =f 2*g /g )
4 2 2P,2P 4P,-4P
div(f ) = 4(P) - (4P) - 3(O)
 4 2
(f =f *g /g )
8 4 4P,4P 8P,-8P
div(f ) = 8(P) - (8P) - 7(O)
 8
(f =f *g /g )
9 8 8P,P 9P,-9P
div(f ) = 9(P) - (9P) - 8(O)
 9
: : : Log n - step
2
div(f ) = n(P)-n(O)
 n
Supersingular curves
An elliptic curve E/ F is called supersingular if it has
q
E[ps](F ) = {O} or p|t , where p=char F .
q q
- ∃distortion map ⇒ Eta pairing approach
- small embedding degree
p=2 ⇒ k ≤ 4
p=3 ⇒ k ≤ 6,
over prime fields F with p ≥ 5 ⇒ k ≤ 2.
p
- small number of curves
10