[Paper Review] Bilinear Pairings on Elliptic Curves

Andreas Enge|arXiv (Cornell University)|Jan 23, 2013

Cryptography and Data Security1 references6 citations

TL;DR

This paper provides a self-contained, rigorous introduction to bilinear pairings on elliptic curves over finite fields, focusing on the Weil and Tate pairings, their equivalence via Weil reciprocity, and advanced constructions like ate, R-ate, and optimal pairings. It demonstrates that pairings with shorter evaluation loops—achieved through twisted variants and polynomial families—enable significant performance improvements in pairing-based cryptography by reducing computational complexity by a factor of φ(k).

ABSTRACT

I denne oppgåva studerer vi bilineære parringer på elliptiske kurver. Først gir vi ein introduksjon til algebraisk geometri og spesielt omgrepet divisorar. Vidare ser vi på elliptiske kurver og deira aritmetikk. Vi ser på to ulike parringer på elliptiske kurver, Weilparringa og Tateparringa. Vi skildrar Weilparringa på to ulike måtar og viser provet for relasjonen mellom dei. Vidare skildrar vi Tateparringa i detalj og syner eigenskapane til begge parringane. Vi syner òg korleis dei kan reknast ut. Til slutt skildrar vi MOV-angrepet og den tredelte nøkkelavtala til Diffie- Hellman som døme på bruk av parringar i kryptografi.

Motivation & Objective

• To provide a mathematically rigorous, self-contained introduction to bilinear pairings on elliptic curves over finite fields, tailored for cryptographic applications.
• To establish the equivalence of three definitions of the Weil pairing using Weil reciprocity, ensuring foundational consistency.
• To present advanced pairing constructions—such as ate, R-ate, and optimal pairings—highlighting their bilinearity, non-degeneracy, and efficiency gains.
• To analyze the computational trade-offs in pairing evaluation, particularly the balance between loop length reduction and number of function evaluations.
• To survey recent advances in constructing families of elliptic curves with small embedding degree k and efficient pairing computation via polynomial parameterization.

Proposed method

• Uses Weil reciprocity to prove the equivalence of three definitions of the Weil pairing, establishing a solid theoretical foundation.
• Applies the theory of divisors and rational functions on elliptic curves to define the Weil and Tate pairings, with explicit constructions using line functions and poles.
• Introduces twisted pairings (e.g., twisted ate) to reduce the loop length in pairing computation by a factor of φ(k), leveraging Frobenius endomorphism properties.
• Employs addition-negation sequences and lattice reduction techniques over Z[X] to find short vectors that minimize the number of scalar multiplications in pairing evaluation.
• Constructs optimal pairings via polynomial families (e.g., p(X), r(X), u(X)) where r(X) is irreducible and p(X) ≡ y(X) mod r(X)^2, enabling constant-time base function evaluation.
• Analyzes the computational cost of evaluating pairing functions, showing that while loop length is reduced by φ(k), the number of evaluations may offset gains unless coefficients are structured.

Experimental results

Research questions

• RQ1 How can the three different definitions of the Weil pairing be proven equivalent using Weil reciprocity?
• RQ2 What are the conditions under which the ate, R-ate, and optimal pairings achieve a reduction in loop length by a factor of φ(k)?
• RQ3 How do twisted variants of the ate pairing improve efficiency in pairing computation on elliptic curves?
• RQ4 In what way do polynomial families of elliptic curves enable the construction of optimal pairings with minimal evaluation cost?
• RQ5 To what extent do arithmetic properties of coefficient polynomials (e.g., divisibility by prime factors of k) influence the efficiency of pairing computation?

Key findings

• The three definitions of the Weil pairing are proven equivalent using Weil reciprocity, ensuring consistency in foundational pairing theory.
• The ate and R-ate pairings achieve a loop length reduction by a factor of φ(k) compared to the standard Miller loop, significantly improving pairing efficiency.
• Twisted variants of the ate pairing allow the use of the Frobenius map to generate points, enabling simultaneous evaluation of multiple pairing functions with shared base point.
• Vercauteren’s specialization of the Heß pairing, where y(X) = p(X), leads to a short vector in the Z[X]-lattice, enabling efficient evaluation of f_{t_i, Q} via a single base function f_{x_0, Q}.
• For the family with k=10, the optimal pairing achieves a speed-up proportional to φ(10) = 4, with explicit polynomials p(X), r(X), and u(X) that yield curves with small embedding degree and efficient pairing computation.
• Despite theoretical gains of φ(k) in loop length, the number of function evaluations may offset performance improvements unless coefficient structure is exploited, as in polynomial families with small, meaningful coefficients.