In this paper we show that the Ate pairing, originally defined for elliptic curves, generalises to hyperelliptic curves and in fact to arbitrary algebraic curves. It has the following surprising properties: The loop length in Miller's algorithm can be up to $g$ times shorter than for the Tate pairing, with $g$ the genus of the curve, and the pairing is also automatically reduced, i.e., no final exponentiation is needed.
|Translated title of the contribution||Ate Pairing on Hyperelliptic Curves|
|Title of host publication||Advances in Cryptology - EUROCRYPT 2007|
|Publisher||Springer Berlin Heidelberg|
|Publication status||Published - 2007|
Bibliographical noteOther page information: 430-447
Conference Proceedings/Title of Journal: Advances in Cryptology - EUROCRYPT 2007
Other identifier: 2000709