Abstract
This paper presents efficient formulas to compute Miller doubling and Miller addition utilizing degree-3 twists on curves with j-invariant 0 written in Hessian form. We give the formulas for both odd and even embedding degrees and for pairings on both G1×G2 and G2×G1. We propose the use of embedding degrees 15 and 21 for 128-bit and 192-bit security respectively in light of the NFS attacks and their variants. We give a comprehensive comparison with other curve models; our formulas give the fastest known pairing computation for embedding degrees 15, 21, and 24.
| Original language | English |
|---|---|
| Title of host publication | Progress in Cryptology – INDOCRYPT 2018 |
| Publication status | Published - 2018 |