Avoiding Full Extension Field Arithmetic in Pairing Computations - PowerPoint PPT Presentation

Introduction Motivation Miller 2 n -tupling Results Related Work Avoiding Full Extension Field Arithmetic in Pairing Computations Craig Costello craig.costello@qut.edu.au Queensland University of Technology AfricaCrypt 2010 Joint work with Colin Boyd, Juanma Gonzalez-Nieto, Kenneth Koon-Ho Wong Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Miller 2 n -tupling Results Related Work Motivation Faster pairings mean more efficient... ID-based encryption (IBE) ID-based key agreement short signatures group signatures ring signatures certificateless encryption hierarchical encryption attribute-based encryption ... Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Miller 2 n -tupling Results Related Work Table of contents 1 Introduction Pairings and Miller’s algorithm The evolution of Miller’s algorithm: state-of-the-art pairings 2 Motivation 3 Miller 2 n -tupling 4 Results 5 Related Work Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Pairings on ordinary elliptic curves over large prime fields Need two linearly independent points R and S of large prime order r on E ( F p ), i.e. need two subgroups of E [ r ] E ( F p k ) is the smallest extension that contains two such subgroups (all r + 1 subgroups in fact) k is the embedding degree, first value such that r | p k − 1 Need a function f R with divisor div ( f R ) = r ( R ) − r ( O ) Weil pairing methodology e ( R , S ) = f R ( S ) / f S ( R ) ∈ F p k Tate pairing methodology e ( R , S ) = f R ( S ) p k − 1 ∈ F p k Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work The pairing evaluation functions What do the functions f R ( S ) and f S ( R ) look like? div ( f R ) = r ( R ) − r ( O ), i.e. a zero of order r at R , and a pole of order r at infinity ( O ). Indeterminate f R , f S are of degree r (at least in affine form) If R ∈ E ( F p ) and S ∈ E ( F p k ), then f R ( S ) will have coefficients in F p , evaluated at elements in F p k f S ( R ) will have coefficients in F p k , evaluated at elements in F p Too much to store f R explicitly before evaluating at S Therefore, evaluate at S as you build the function and vice versa. Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Miller’s algorithm Input: R , S and r = ( r ⌊ log ( r ) ⌋ , ..., r 0 ) 2 Output: f R ( S ) f ← 1, T ← R for i from ⌊ log ( r ) ⌋ − 1 to 0 do Compute g = l / v in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 if r i = 1 then 4 i. Compute g = l / v in the chord-and-tangent addition of T + R ii. T ← T + R iii. f ← f · g ( S ) end if end for : return f Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Miller’s algorithm for the Weil pairing methodology Initially: run twice to compute e ( R , S ) = f R ( S ) / f S ( R ) Input: R , S and r = ( r ⌊ log ( r ) ⌋ , ..., r 0 ) 2 Output: f R ( S ) (first time) and f S ( R ) (second time) f ← 1, T ← R for i from ⌊ log ( r ) ⌋ − 1 to 0 do Compute g = l / v in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 if r i = 1 then 4 i. Compute g = l / v in the chord-and-tangent addition of T + R ii. T ← T + R iii. f ← f · g ( S ) end if end for : return f Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Miller’s algorithm for the Tate pairing methodology Idea: run once and exponentiate e ( R , S ) = f R ( S ) p k − 1 Input: R , S and r = ( r ⌊ log ( r ) ⌋ , ..., r 0 ) 2 Output: f R ( S ) f ← 1, T ← R for i from ⌊ log ( r ) ⌋ − 1 to 0 do Compute g = l / v in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 if r i = 1 then 4 i. Compute g = l / v in the chord-and-tangent addition of T + R ii. T ← T + R iii. f ← f · g ( S ) end if return f ← f ( p k − 1) end for : Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Miller’s algorithm with no inversions Ideas: v ’s are in subfields so discard + projective coords Input: R , S and r = ( r ⌊ log ( r ) ⌋ , ..., r 0 ) 2 Output: f R ( S ) f ← 1, T ← R for i from ⌊ log ( r ) ⌋ − 1 to 0 do Compute g = l / v in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 if r i = 1 then 4 i. Compute g = l / v in the chord-and-tangent addition of T + R ii. T ← T + R iii. f ← f · g ( S ) end if return f ← f ( p k − 1) end for : Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Miller’s algorithm with optimal loop length Idea: Minimize loop length + low Hamming-weight Input: R , S and m opt = ( m ⌊ log ( m opt ) ⌋ , ..., m 0 ) 2 Output: f R ( S ) f ← 1, T ← R for i from ⌊ log ( m opt ) ⌋ − 1 to 0 do Compute g = l in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 if r i = 1 then 4 i. Compute g = l in the chord-and-tangent addition of T + R ii. T ← T + R iii. f ← f · g ( S ) end if return f ← f ( p k − 1) end for : Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work The state-of-the-art Input: R , S and m opt = ( m ⌊ log ( m opt ) ⌋ , ..., m 0 ) 2 Output: f R ( S ) f ← 1, T ← R for i from ⌊ log ( m opt ) ⌋ − 1 to 0 do Compute g = l in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 return f ← f ( p k − 1) end for : Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Pairings and Miller’s algorithm Miller 2 n -tupling The evolution of Miller’s algorithm: state-of-the-art pairings Results Related Work Tate vs. ate groups G 1 = E [ r ] ∩ ker ( π p − [1]) and G 2 = E [ r ] ∩ ker ( π p − [ p ]), i.e. G 1 ∈ E ( F p ) (base field) and G 2 ∈ E ( F p k ) (full ext. field) Use twisted curve E ′ ∼ 2 ∼ = E to define G ′ = G 2 but G ′ 2 ∈ E ( F p k / d ) (twisted subfield) Tate-like pairings 2nd argument S ∈ G ′ 1st argument: R ∈ G 1 2 Ate-like pairings 1st argument: R ∈ G ′ 2nd argument S ∈ G 1 2 Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Miller 2 n -tupling Results Related Work What else can we do? Red stuff : Optimized or exhausted or given enough attention Input: R , S and m opt = ( m ⌊ log ( m opt ) ⌋ , ..., m 0 ) 2 Output: f R ( S ) f ← 1, T ← R for i from ⌊ log ( m opt ) ⌋ − 1 to 0 do Compute g = l in the chord-and-tangent doubling of T 1 T ← [2] T 2 f ← f 2 · g ( S ) 3 end for return f ← f ( p k − 1) Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations

Introduction Motivation Miller 2 n -tupling Results Related Work A closer look at the Miller update step Complexity of operations i. f ← f 2 s k ii. Evaluate g at S 2 k / d · m 1 iii. f ← f · g m k ? i. f is a general element of F p k (can’t do much here) ii. Indeterminate g takes form g ( x , y ) = g x · x + g y · y + g 0 , and is evaluated as g ( S x , S y ) ate: g x , g y , g 0 ∈ F p k / d and S x , S y ∈ F p Tate: g x , g y , g 0 ∈ F p and S x , S y ∈ F p k / d iii. KEY: If degree of twist d = 4 or d = 6, then g ( S ) is not a general element of F p k / d (i.e. f · g is not a full extension field multiplication!) Craig Costello Avoiding Full Extension Field Arithmetic in Pairing Computations