The Pairing Computation on Edwards Curves

Abstract

We propose an elaborate geometry approach to explain the group law on twisted Edwards curves which are seen as the intersection of quadric surfaces in place. Using the geometric interpretation of the group law, we obtain the Miller function for Tate pairing computation on twisted Edwards curves. Then we present the explicit formulae for pairing computation on twisted Edwards curves. Our formulae for the doubling step are a little faster than that proposed by Arène et al. Finally, to improve the efficiency of pairing computation, we present twists of degrees 4 and 6 on twisted Edwards curves.

1. Introduction

Pairing-based cryptography has been one of the most active areas in elliptic curve cryptography since 2000. Some details on this subject can be found in [1, 2]. How to compute pairings efficiently is a bottleneck for implementing pairing-based cryptography. The most efficient method of computing pairings is Miller’s algorithm [3]. Consequently, various improvements were presented in [4–8]. One way to improve the efficiency is to find other models of elliptic curves which can provide more efficient algorithms for pairing computation. Edwards curves were one of the popular models. Edwards curve was discovered by Edwards [9] and was applied in cryptography by Bernstein and Lange [10]. Then twisted Edwards curves which are the generalization of Edwards curves were introduced by Bernstein et al. in [11]. Bernstein and Lange also pointed out several advantages of applying the Edwards curves to cryptography. Pairing computation over Edwards curves was first considered in [12, 13]. In 2009, Arène et al. [4] gave the geometric interpretation of the group law and presented explicit formulae for computing the Tate pairing on twisted Edwards curves. Their formulae are faster than all previously proposed formulas for pairings computation on twisted Edwards curves. Their formulae are even competitive with all published formulae for pairing computation on Weierstrass curves. In particular, if a pairing-friendly curve used in a pairing-based protocol is isomorphic or isogenous to an Edwards curve, all the scalar multiplication appearing in the protocol can be computed efficiently [14].

Any elliptic curve defined over a field 𝐾 with characteristic different from 2 is birationally equivalent to an Edwards curve over some extension of 𝐾, that is, a curve given by 𝑥²+𝑦²=1+𝑑𝑥²𝑦² with 𝑑∉{0,1}. In fact, the twisted Edwards curves can be seen as the intersection of two quadratic surfaces in space. That is to say, the twisted Edwards curves can be given by 𝑆𝑊_𝑎,𝑑∶𝑎𝑋²+𝑌²−𝑍²−𝑑𝑊²=0, 𝑋𝑌−𝑍𝑊=0. For general elliptic curves given by intersection of two quadratic surfaces, the geometric interpretation of group law had been discussed by Merriman et al. in [15]. In this paper, we proposed a more detailed geometry approach to explain the group law for the case of twisted Edwards curves which are seen as the intersection of two quadratic surfaces. Using the geometric interpretation of the group law, we obtain the Miller function of Tate pairing computation on twisted Edwards curves. Then we present the explicit formulae for pairing computation on twisted Edwards curves. The doubling step of our formulae is a little faster than that in [4]. Finally, to reduce the cost of evaluating the Miller function on twisted Edwards curve, we employ quadratic, quartic, or sextic twists to the formulae of the Tate pairing computation. The high twists had been sufficiently studied by Costello et al. [16] on Weierstrass curves. As the result given by [17], one elliptic curve and its quartic/sextic twist can not have a rational twisted Edwards model at the same time, so we turn to Weierstrass curves for the high-degree twists of twisted Edwards curves. These twists enable us to reduce the cost of substituting to a half and a third, respectively, in 𝑗=1728 case and 𝑗=0 case.

The remainder of the paper is organized as follows. In Section 2, we provide some backgrounds and notations used in this paper. In Section 3, we give a geometry approach to explain the group law on twisted Edwards curves. In Section 4, we present pairing computation on twisted Edwards curves. In Section 5, we employ quartic and sextic twists to the formulae of the Tate pairing computation. In Section 6, we conclude our paper.

2. Preliminaries

2.1. Tate Pairing

Let 𝑝>3 be a prime, and let 𝔽_𝑞 be a finite field with 𝑞=𝑝^𝑛. 𝐸 is an elliptic curve defined over 𝔽_𝑞 with neutral element denoted by 𝑂. 𝑟 is a prime such that 𝑟∣#𝐸(𝔽_𝑞). Let 𝑘>1 denote the embedding degree with respect to 𝑟; that is, 𝑘 is the smallest positive integer such that 𝑟∣𝑞^𝑘−1. For any point 𝑃∈𝐸(𝔽_𝑞)[𝑟], there exists a rational function 𝑓_𝑃 defined over 𝔽_𝑞 such that div(𝑓_𝑃)=𝑟(𝑃)−𝑟(𝑂), which is unique up to a nonzero scalar multiple. The group of 𝑟th roots of unity in 𝔽_𝑞𝑘 is denoted by 𝜇_𝑟. The reduced Tate pairing is then defined as follows: 𝑇_𝑟∶𝐸𝔽_𝑞[𝑟]×𝐸𝔽_𝑞𝑘⟶𝜇_𝑟∶(𝑃,𝑄)⟼𝑓_𝑃(𝑄)^{(𝑞𝑘−1)/𝑟}. (1) The rational function 𝑓_𝑃 can be computed in polynomial time by using Miller’s algorithm [3]. Let 𝑟=(𝑟_𝑙−1,…,𝑟₁,𝑟₀)₂ be the binary representation of 𝑟, where 𝑟_𝑙−1=1. Let 𝑔_𝑃1,𝑃2∈𝔽_𝑞(𝐸) be the rational function satisfying div(𝑔_𝑃1,𝑃2)=(𝑃₁)+(𝑃₂)−(𝑂)−(𝑃₁+𝑃₂), where 𝑃₁+𝑃₂ denotes the sum of 𝑃₁ and 𝑃₂ on 𝐸 and additions of the form (𝑃₁)+(𝑃₂) denote formal additions in the divisor group. Miller’s algorithm starts with 𝑇=𝑃, and 𝑓=1 is written as in Algorithm 1.

Input:  𝑟=∑𝑙−1𝑖=0𝑟𝑖2𝑖, where 𝑟𝑖∈{0,1}. 𝑃∈𝐸𝔽𝑞,𝑄∈𝐸𝔽𝑞𝑘. Output:  𝑓(𝑞𝑘𝑟−1)/𝑟(𝑄) (1) 𝑓←1,𝑇←𝑃 (2) for  𝑖=𝑙−2 down to 0 do do (3)  𝑓←𝑓2⋅𝑔𝑇,𝑇(𝑄),𝑇←2𝑇 (4)  if  𝑟𝑖=1 then then (5)   𝑓←𝑓⋅𝑔𝑇,𝑃(𝑄),𝑇←𝑇+𝑃 (6)  end if (7) end for (8) return 𝑓(𝑞𝑘−1)/𝑟

Algorithm 1 

Miller's algorithm.

2.2. Edwards Curves

For char(𝔽_𝑞)≠2, a twisted Edwards curve defined over 𝔽_𝑞 is given by 𝐸_𝑎,𝑑∶𝑎𝑥²+𝑦²=1+𝑑𝑥²𝑦², (2) where 𝑎,𝑑 are distinct nonzero elements of 𝔽_𝑞. The projective closure of 𝐸_𝑎,𝑑 in ℙ² is (𝑋∶𝑌∶𝑍)∈ℙ²∶𝑎𝑋²𝑍²+𝑌²𝑍²=𝑍⁴+𝑑𝑋²𝑌². (3) This curve consists of the points (𝑥,𝑦) on the affine curve 𝐸_𝑎,𝑑, embedded as usual into ℙ² by (𝑥,𝑦)↦(𝑥∶𝑦∶1), and extra points at infinity, that is, points when 𝑍=0. There are exactly two such points, namely, Ω₁=(1∶0∶0) and Ω₂=(0∶1∶0). These points are singular.

In fact, the twisted Edwards curve can be seen as the intersection of two quadric surfaces in space. That is, the twisted Edwards curve can be written as 𝑆𝑊_𝑎,𝑑:𝑎𝑋²+𝑌²−𝑍²−𝑑𝑊²=0,𝑋𝑌−𝑍𝑊=0. (4)

More generally, every elliptic curve defined over a field 𝐾 with char(𝐾)≠2 can be written in this normal form over an extension of 𝐾. Set 𝑂=(0∶1∶0∶1) as the neutral element; the group law on (4) is given by −()=(),𝑋𝑋∶𝑌∶𝑊∶𝑍−𝑋∶𝑌∶−𝑊∶𝑍₁∶𝑌₁∶𝑊₁∶𝑍₁+𝑋₂∶𝑌₂∶𝑊₂∶𝑍₂=𝑋₃∶𝑌₃∶𝑊₃∶𝑍₃, (5) where 𝑋₃=𝑋₁𝑌₂+𝑌₁𝑋₂𝑍₁𝑍₂−𝑑𝑊₁𝑊₂,𝑌₃=𝑌₁𝑌₂−𝑎𝑋₁𝑋₂𝑍₁𝑍₂+𝑑𝑊₁𝑊₂,𝑊₃=𝑌₁𝑌₂−𝑎𝑋₁𝑋₂𝑋₁𝑌₂+𝑋₂𝑌₁,𝑍₃=𝑍₁𝑍₂−𝑑𝑊₁𝑊₂𝑍₁𝑍₂+𝑑𝑊₁𝑊₂. (6)

The point 𝑂^′=(0∶−1∶0∶1) has order 2. Note that the above formula is unified; that is, it can be applied to both adding two distinct points and doubling a point. The fast arithmetic on twisted Edwards curves given by (4) can be found in [18, 19].

We use 𝐦 and 𝐬 to denote the costs of multiplication and squaring in the base field 𝔽_𝑞, while 𝐌 and 𝐒 denote the costs of multiplication and squaring in the extension 𝔽_𝑞𝑘.

3. Geometric Interpretation of the Group Law on Twisted Edwards Curves

The aim of this section is to give the elaborate geometric interpretation of the group law on twisted Edwards curves which are seen as the intersection of two quadric surfaces in space. We consider projective planes which are given by homogeneous projective equations Π=0. In this paper, we still use the symbol Π to denote projective planes. In fact, any plane Π intersects 𝑆𝑊_𝑎,𝑑 at exactly four points. Although these planes are not functions on 𝑆𝑊_𝑎,𝑑, their divisors can be well defined as div(Π)=_{𝑅∈Π∩𝑆𝑊𝑎,𝑑}𝑛_𝑅(𝑅), (7) where 𝑛_𝑅 is the intersection multiplicity of Π and 𝑆𝑊_𝑎,𝑑 at 𝑅. Then the quotient of two projective planes is a well-defined function which gives principal divisor. As we will see, this divisor leads to the geometric interpretation of the group law.

When saying plane Π passes three points 𝑃₁,𝑃₂, and 𝑃₃ (not necessary distinct), we means that Π exactly satisfies div(Π)≥(𝑃₁)+(𝑃₂)+(𝑃₃). In fact, by Riemann-Roch theorem or by explicit discussion on multiplicity, one can prove that there exists a unique plane which satisfies the above inequality. So we may denote this plane by Π_{𝑃1,𝑃2,𝑃3} from now on.

3.1. Group Law over the Twisted Edwards Curves

Abel-Jacobi theorem connects the group law with principal divisor. And we can get the lemma below.

Lemma 1. For twist Edwards curve 𝑆𝑊_𝑎,𝑑 with neutral element 𝑂=(0∶1∶0∶1), let 𝑂^′=(0∶−1∶0∶1). Then 4 points (not necessary distinct) 𝑃₁, 𝑃₂, 𝑃₃, and 𝑃₄ satisfy 𝑃₁+𝑃₂+𝑃₃+𝑃₄=𝑂^′ if and only if there is a plane Π with div(Π)=(𝑃₁)+(𝑃₂)+(𝑃₃)+(𝑃₄).

Proof. Firstly, it is an easy calculation to get that div(𝑋−𝑊)=3(𝑂)+(𝑂^′).
Then the “if” part follows directly: if div(Π)=(𝑃₁)+(𝑃₂)+(𝑃₃)+(𝑃₄), the principal divisor div(Π/(𝑋−𝑊))=(𝑃₁)+(𝑃₂)+(𝑃₃)+(𝑃₄)−3(𝑂)−(𝑂^′) is translated into equation 𝑃₁+𝑃₂+𝑃₃+𝑃₄=𝑂^′ by the Abel-Jacobi Theorem.
For the “only if” part, suppose that 𝑃₁+𝑃₂+𝑃₃+𝑃₄=𝑂^′. Consider the plane Π_{𝑃1,𝑃2,𝑃3}; we can assume that div(Π_{𝑃1,𝑃2,𝑃3})=(𝑃₁)+(𝑃₂)+(𝑃₃)+(𝑃^′₄), so it derives 𝑃₁+𝑃₂+𝑃₃+𝑃^′₄=𝑂^′ from the “if” part. Then we get 𝑃₄=𝑃^′₄; that is, div(Π_{𝑃1,𝑃2,𝑃3})=(𝑃₁)+(𝑃₂)+(𝑃₃)+(𝑃₄).

By this lemma, we can easily construct planes to give the group law. The fourth intersection of Π_{𝑃1,𝑂,𝑂′} and the curve is −𝑃₁, that is, the negative point of 𝑃₁. The fourth intersection of Π_{𝑃1,𝑃2,𝑂′} and the curve is −𝑃₁−𝑃₂, and its negative point gives 𝑃₁+𝑃₂. Actually, this geometric interpretation is parallel with the tangent and chord law for the cubic plane curves.

The neutral element we chose here is the same with that of [11], so we can claim that our explicit formulae for negative point, point addition, and point doubling are equivalent with which of [11].

4. Miller Function over 𝑆𝑊_𝑎,𝑑

4.1. Construction of Miller Function

In this section we construct the Miller function over 𝑆𝑊_𝑎,𝑑. Let 𝑃₁ and 𝑃₂ be two points on 𝑆𝑊_𝑎,𝑑; by Lemma 1, we can get divΠ_{𝑃1,𝑃2,𝑂′}=𝑃₁+𝑃₂+𝑂^′+−𝑃₁−𝑃₂,divΠ_{𝑃1+𝑃2,𝑂,𝑂′}=𝑃₁+𝑃₂+(𝑂)+𝑂^′+−𝑃₁−𝑃₂. (8) Thus, Πdiv^{𝑃1,𝑃2,𝑂′}Π_{𝑃1+𝑃2,𝑂,𝑂′}=𝑃₁+𝑃₂−𝑃₁+𝑃₂−(𝑂). (9) So for addition steps, the Miller function 𝑔_𝑇,𝑃 over 𝑆𝑊_𝑎,𝑑 can be given by setting 𝑃₁=𝑇, 𝑃₂=𝑃: 𝑔_𝑇,𝑃=Π_{𝑇,𝑃,𝑂′}Π_{𝑇+𝑃,𝑂,𝑂′}. (10) For doubling steps, we set 𝑃₁=𝑃₂=𝑇, and the Miller function 𝑔_𝑇,𝑇 over 𝑆𝑊_𝑎,𝑑 is given as 𝑔_𝑇,𝑇=Π_{𝑇,𝑇,𝑂′}Π_{2𝑇,𝑂,𝑂′}. (11)

Then the remaining work is to compute the equation of these planes. The planes we use are of the form 𝐶_𝑋𝑋+𝐶_𝑌(𝑌+𝑍)+𝐶_𝑊𝑊=0, because they always pass through 𝑂^′=(0∶−1∶0∶1). Thus we only need to compute 𝐶_𝑋, 𝐶_𝑌, and 𝐶_𝑊. To get a unified description, we use 𝑃₁, 𝑃₂ for both addition and doubling steps and consider 𝑃₁≠𝑃₂ and 𝑃₁=𝑃₂, respectively, when necessary. Assume that 𝑃₁=(𝑋₁∶𝑌₁∶𝑊₁∶𝑍₁), 𝑃₂=(𝑋₂∶𝑌₂∶𝑊₂∶𝑍₂), and 𝑃₃=𝑃₁+𝑃₂=(𝑋₃∶𝑌₃∶𝑊₃∶𝑍₃).

4.2. Equation of Π_{𝑃1,𝑃2,𝑂′} with 𝑃₁≠𝑃₂

In the case that 𝑃₁, 𝑃₂, and 𝑂^′ are pairwise distinct points on 𝑆𝑊_𝑎,𝑑, by solving linear equations, we get the coefficients of the plane Π_{𝑃1,𝑃2,𝑂′} as follows: 𝐶_𝑋=𝑊₂𝑍₁+𝑌₁−𝑊₁𝑍₂+𝑌₂,𝐶_𝑌=𝑋₂𝑊₁−𝑋₁𝑊₂,𝐶_𝑊=𝑋₁𝑌₂+𝑍₂−𝑋₂𝑍₁+𝑌₁. (12)

4.3. Equation of Π_{𝑃1,𝑃2,𝑂′} with 𝑃₁=𝑃₂

Suppose that 𝑃₁=𝑃₂≠𝑂^′. The tangent line to 𝑆𝑊_𝑎,𝑑 at 𝑃₁ is the intersection of the tangent planes to 𝑎𝑋²+𝑌²−𝑍²−𝑑𝑊²=0 and 𝑋𝑌−𝑍𝑊=0 at 𝑃₁. The tangent plane to 𝑎𝑋²+𝑌²−𝑍²−𝑑𝑊²=0 at 𝑃₁ is 𝑎𝑋₁𝑋+𝑌₁𝑌−𝑍₁𝑍−𝑑𝑊₁𝑊=0. The tangent plane to 𝑋𝑌−𝑍𝑊=0 at 𝑃₁ is 𝑌₁𝑋+𝑋₁𝑌−𝑊₁𝑍−𝑍₁𝑊=0. Then Π_{𝑃1,𝑃1,𝑂′} is of the form: 𝜆𝑎𝑋₁𝑋+𝑌₁𝑌−𝑍₁𝑍−𝑑𝑊₁𝑊+𝜇𝑌₁𝑋+𝑋₁𝑌−𝑊₁𝑍−𝑍₁𝑊=0. (13) Note that 𝑂^′∈Π_{𝑃1,𝑃1,𝑂′}; that is, 𝜆(𝑌₁+𝑍₁)+𝜇(𝑋₁+𝑊₁)=0. One can verify that 𝜆=−𝑋₁, 𝜇=𝑍₁ satisfy the equation. Hence, the equation of Π_{𝑃1,𝑃1,𝑂′} is −𝑋₁𝑎𝑋₁𝑋+𝑌₁𝑌−𝑍₁𝑍−𝑑𝑊₁𝑊+𝑍₁𝑌₁𝑋+𝑋₁𝑌−𝑊₁𝑍−𝑍₁𝑊=0. (14)

Then we can get the coefficients of Π_{𝑃1,𝑃1,𝑂′} as follows: 𝐶_𝑋=𝑌₁𝑍₁−𝑎𝑋²₁,𝐶_𝑌=𝑋₁𝑍₁−𝑋₁𝑌₁,𝐶_𝑊=𝑑𝑋₁𝑊₁−𝑍²₁. (15)

4.4. Equation of Π_{𝑃3,𝑂,𝑂′}

The plane Π_{𝑃3,𝑂,𝑂′} can be regarded as a special case of Π_{𝑃1,𝑃2,𝑂′}. For 𝑃₃≠𝑂, 𝑂^′, we have 𝐶_𝑋=𝑊₃,𝐶_𝑌=0,𝐶_𝑊=−𝑋₃. (16) Thus, we have Π_{𝑃3,𝑂,𝑂′}∶𝑊₃𝑋−𝑋₃𝑊=0.

5. Pairing Computation

In this section, we analysis steps in Miller’s algorithm explicitly. For an addition step or doubling step, as is shown in Algorithm 1, each addition or doubling step consists of three parts: computing the point 𝑇+𝑃 or 2𝑇 and the function 𝑔_𝑇,𝑃 or 𝑔_𝑇,𝑇, evaluating 𝑔_𝑇,𝑃 or 𝑔_𝑇,𝑃 at 𝑄, and then updating the variable 𝑓 by 𝑓←𝑓⋅𝑔_𝑇,𝑃(𝑄) or by 𝑓←𝑓²⋅𝑔_𝑇,𝑇(𝑄).

The updating part, as operation in 𝔽_𝑞𝑘, costs 1𝐌 for addition step and 1𝐌+1𝐒 for doubling step. It is usually the main cost but with little room for optimization in one step. For the evaluating part, some standard methods such as denominator elimination and subfield simplification can be used, as we introduce below.

We assume that embedding degree 𝑘 is even. Let 𝛿 be a generator of 𝔽_𝑞𝑘 over 𝔽_𝑞𝑘/2 with 𝛿²∈𝔽_𝑞𝑘/2. Suppose that 𝑄^′=(𝑋₀∶𝑌₀∶𝑊₀∶𝑍₀)∈𝑆𝑊_𝑎𝛿⁻²_,𝑑𝛿⁻²(𝔽_𝑞𝑘/2); we can see that 𝑄=(𝑋₀∶𝛿𝑌₀∶𝑊₀∶𝛿𝑍₀)∈𝑆𝑊_𝑎,𝑑(𝔽_𝑞𝑘). If 𝑃₃=𝑃₁+𝑃₂≠𝑂, 𝑂^′, for evaluation of 𝑔_𝑃1,𝑃2(𝑄), we have 𝑔_𝑃1,𝑃2(𝑄)=Π_{𝑃1,𝑃2,𝑂′}(𝑄)Π_{𝑃3,𝑂,𝑂′}(𝑄)=𝐶_𝑋𝑋₀+𝐶_𝑌𝛿𝑌₀+𝑍₀+𝐶_𝑊𝑊₀𝑊₃𝑋₀−𝑋₃𝑊₀=𝐶_𝑋𝑋₀/𝑌₀+𝑍₀+𝐶_𝑌𝛿+𝐶_𝑊𝑊₀/𝑌₀+𝑍₀𝑊₃𝑋₀−𝑋₃𝑊₀/𝑌₀+𝑍₀∈𝐶_𝑋𝜃+𝐶_𝑌𝛿+𝐶_𝑊𝜂𝔽^∗_𝑞𝑘/2, (17) where 𝜃=𝑋₀/(𝑌₀+𝑍₀) and 𝜂=𝑊₀/(𝑌₀+𝑍₀). Note that 𝜃,𝜂∈𝔽_𝑞𝑘/2 and they are fixed during the whole computation, so they can be precomputed. The coefficients 𝐶_𝑋, 𝐶_𝑌, and 𝐶_𝑊 are in 𝔽_𝑞; thus the evaluation at 𝑄 given the coefficients of the plane can be computed in 𝑘𝐦 (multiplications by 𝜃 and 𝜂 need (𝑘/2)𝐦 each).

The computation of the coordinates of points and the coefficients of planes, as a part of much variety, is discussed, respectively, for addition and doubling step as follows.

5.1. Addition Steps

Let 𝑃₁=𝑇 and 𝑃₂=𝑃 be distinct points with 𝑍₁𝑍₂≠0. By variant of formulae of (6) and (12), the explicit formulas for computing 𝑃₃=𝑇+𝑃 and 𝐶_𝑋, 𝐶_𝑌, and 𝐶_𝑊 are given as follows: 𝐴=𝑋₁⋅𝑋₂,𝐵=𝑌₁⋅𝑌₂,𝐶=𝑍₁⋅𝑊₂,𝐷=𝑍₂⋅𝑊₁,𝐸=𝑊₁⋅𝑊₂,𝐹=𝑋₁−𝑌₁⋅𝑋₂+𝑌₂−𝐴+𝐵,𝐺=𝐵+𝑎𝐴,𝐻=𝐷−𝐶,𝐼=𝐷+𝐶,𝑋₃=𝐼⋅𝐹,𝑌₃𝑍=𝐺⋅𝐻,₃=𝐹⋅𝐺,𝑊₃𝐶=𝐼⋅𝐻,_𝑋=𝑊₁−𝑌₁⋅𝑊₂+𝑌₂𝐶−𝐸+𝐵+𝐻,_𝑊=𝑋₂⋅𝑍₁−𝑋₁⋅𝑍₂𝐶−𝐹,_𝑌=𝑋₁−𝑊₁⋅𝑋₂+𝑊₂−𝐴+𝐸. (18) With these formulas, 𝑇+𝑃 and 𝐶_𝑋, 𝐶_𝑌, and 𝐶_𝑊 can be computed in 14𝐦+1𝐦_𝐜, where 1𝐦_𝐜 is constant multiplication by 𝑎. For a mixed addition step, in which the base point 𝑃 is chosen to have 𝑍₂=1, the costs reduce to 12𝐦+1𝐦_𝐜.

Therefore, the total costs of an addition step are 1𝐌+𝑘𝐦+14𝐦+1𝐦_𝐜, while a mixed addition step costs 1𝐌+𝑘𝐦+12𝐦+1𝐦_𝐜.

5.2. Doubling Steps

For 𝑃₁=𝑃₂=𝑇, 𝑃₃=2𝑇. By the formulae of (6) and (15), our explicit formulas for computing 𝑃₃=2𝑇 and 𝐶_𝑋, 𝐶_𝑌, 𝐶_𝑊 are given as follows: 𝐴=𝑋₁²,𝐵=𝑌₁²,𝐶=𝑍₁²,𝑋𝐷=𝑎𝐴,𝐸=𝐵+𝐷,𝐹=2𝐶−𝐸,𝐺=₁+𝑌₁²−𝐴−𝐵,𝐻=𝑌₁+𝑍₁²𝑋−𝐵−𝐶,₃=𝐺⋅𝐹,𝑌₃=𝐸⋅(𝐵−𝐷),𝑍₃𝑊=𝐸⋅𝐹,₃=𝐺⋅(𝐵−𝐷),2𝐶_𝑋=𝐻−2𝐷,2𝐶_𝑌=𝑋₁+𝑍₁²−𝐴−𝐶−𝐺,2𝐶_𝑊=𝑑𝑋₁+𝑊₁²−𝐴−𝐶−𝐸. (19)

By the above formulae, 2𝑇 and 𝐶_𝑋, 𝐶_𝑌, and 𝐶_𝑊 can be computed in 4𝐦+7𝐬+2𝐦_𝐜, where 2𝐦_𝐜 are constant multiplications by 𝑎 and 𝑑.

So total costs of our formulae for a doubling step are 1𝐌+1𝐒+𝑘𝐦+4𝐦+7𝐬+2𝐦_𝐜, while the total costs of the formulae for the doubling step proposed in [4] are 1𝐌+1𝐒+𝑘𝐦+6𝐦+5𝐬+2𝐦_𝐜, where 2𝐦_𝐜 are both constant multiplication by 𝑎.

6. High-Degree Twists

Let 𝑑∣𝑘, an elliptic curve 𝐸^′ over 𝔽_{𝑞𝑘/𝑑} is called a twist of degree 𝑑 of 𝐸/𝔽_{𝑞𝑘/𝑑} if there is an isomorphism 𝜓∶𝐸^′→𝐸 defined over 𝔽_𝑞𝑘, and this is the smallest extension of 𝔽_{𝑞𝑘/𝑑} over which 𝜓 is defined. Depending on the 𝑗-invariant 𝑗(𝐸) of 𝐸, there exist twists of degree at most 6, since char(𝔽_𝑞)>3. Pairing friendly curves with twists of degree higher than 2 arise from constructions with 𝑗-invariants 𝑗(𝐸)=0 and 𝑗(𝐸)=1728.

6.1. Edwards Curves with 𝑗=1728

For twisted Edwards curve 𝐸_𝑎,−𝑎∶𝑎𝑥²+𝑦²=1−𝑎𝑥²𝑦², the 𝑗-invariant equals to 1728; hence, there exist twists of degree 4. The case 𝑎=1 is the “classical” Edwards curve 𝑥²+𝑦²=1−𝑥²𝑦² with complex multiplication 𝐷=−4 [20].

Lemma 2. Assume that 4∣𝑘, 𝛿 is a generator of 𝔽_𝑞𝑘 over 𝔽_𝑞𝑘/4 and 𝛿⁴∈𝔽_𝑞𝑘/4, which implies 𝛿²∈𝔽_𝑞𝑘/2. Then the Weierstrass curve 𝑊_𝑎∶2𝑎𝑣²=𝑢³+1𝛿⁴𝑢 (20) is a twist of degree 4 over 𝔽_𝑞𝑘/4 of 𝐸_𝑎,−𝑎. The isomorphism can be given as 𝜓∶𝑊_𝑎⟶𝐸_𝑎,−𝑎()⟼=𝑢𝑢,𝑣𝑥,𝑦,𝛿𝛿𝑣²𝑢−1𝛿².𝑢+1 (21)

Proof. Firstly, we prove that 𝜓 is well defined; that is, 𝜓(𝑢,𝑣)∈𝐸_𝑎,−𝑎. Note that 1𝑥²=𝛿²𝑣²𝑢²=𝑎2𝛿²𝑢𝛿⁴𝑢²+1. (22) We have 1𝑥²𝑎−𝑎=2𝛿²𝑢𝛿²𝑢−1²,1𝑥²𝑎+𝑎=2𝛿²𝑢𝛿²𝑢+1². (23) Then 1−𝑎𝑥²1+𝑎𝑥²=𝛿²𝑢−1𝛿²𝑢+1²=𝑦²,thus𝑎𝑥²+𝑦²=1−𝑎𝑥²𝑦². (24)
Moreover, it can be easily checked that 𝜓 is invertible and satisfies 𝜓(𝑂)=𝑂; that is, 𝜓 is an isomorphism. Besides, the minimal field that 𝜓 can be defined over is 𝔽_𝑞𝑘 which has degree 4 over 𝔽_𝑞𝑘/4. Hence, the twist degree is 4.

For 𝑄^′∈𝑊_𝑎(𝔽_𝑞𝑘/4), we have (𝑥_𝑄,𝑦_𝑄)=𝜓(𝑄^′)∈𝐸_𝑎,−𝑎(𝔽_𝑞𝑘). Then its corresponding point 𝑄∈𝑆𝑊_𝑎,−𝑎(𝔽_𝑞𝑘) can be given as (𝑋_𝑄∶𝑌_𝑄∶𝑊_𝑄∶𝑍_𝑄)=(𝑥_𝑄∶𝑦_𝑄∶𝑥_𝑄𝑦_𝑄∶1). One can check by substitution that 𝑋_𝑄+𝑊_𝑄𝑌_𝑄+𝑍_𝑄=𝑥_𝑄=𝑢,𝑋𝛿𝑣_𝑄−𝑊_𝑄𝑌_𝑄+𝑍_𝑄=𝑥_𝑄⋅1−𝑦_𝑄1+𝑦_𝑄=1𝛿³𝑣. (25) For 𝜃=𝑢/(2𝑣) and 𝜂=1/(2𝑣), we have 𝑋_𝑄/(𝑌_𝑄+𝑍_𝑄)=𝜃𝛿⁻¹+𝜂𝛿⁻³ and 𝑊_𝑄/(𝑌_𝑄+𝑍_𝑄)=𝜃𝛿⁻¹−𝜂𝛿⁻³ with 𝜃,𝜂∈𝔽_𝑞𝑘/4. Then for the evaluation of 𝑔_𝑃1,𝑃2(𝑄) with 𝑃₃=𝑃₁+𝑃₂≠𝑂,𝑂^′, we get 𝑔_𝑃1,𝑃2(𝑄)=Π_{𝑃1,𝑃2,𝑂′}(𝑄)Π_{𝑃3,𝑂,𝑂′}(𝑄)=𝐶_𝑋𝑋_𝑄+𝐶_𝑌𝑌_𝑄+𝑍_𝑄+𝐶_𝑊𝑊_𝑄𝑊₃𝑋_𝑄−𝑋₃𝑊_𝑄=𝐶_𝑋𝜃𝛿⁻¹+𝜂𝛿⁻³+𝐶_𝑌+𝐶_𝑊𝜃𝛿⁻¹−𝜂𝛿⁻³𝑊₃𝜃𝛿⁻¹+𝜂𝛿⁻³−𝑋₃𝜃𝛿⁻¹−𝜂𝛿⁻³=𝐶_𝑋−𝐶_𝑊𝜂+𝐶_𝑋+𝐶_𝑊𝜃𝛿²+𝐶_𝑌𝛿³𝑊₃+𝑋₃𝜂+𝑊₃−𝑋₃𝜃𝛿²∈𝐶_𝑋−𝐶_𝑊𝜂+𝐶_𝑋+𝐶_𝑊𝜃𝛿²+𝐶_𝑌𝛿³𝔽^∗_𝑞𝑘/2. (26)

So we can reduce 𝑔_𝑃1,𝑃2(𝑄) to (𝐶_𝑋−𝐶_𝑊)𝜂+(𝐶_𝑋+𝐶_𝑊)𝜃𝛿²+𝐶_𝑌𝛿³. Moreover we may precompute 𝜃 and 𝜂 since they are fixed during the whole computation. When 𝐶_𝑋,𝐶_𝑌,𝐶_𝑊∈𝔽_𝑞, and 𝜃,𝜂∈𝔽_𝑞𝑘/4 are given, the evaluation at 𝑄 can be computed in (𝑘/2)𝐦, with (𝑘/4)𝐦 each for multiplications by 𝜃 and 𝜂.

The high twist not only reduces the cost of evaluating 𝑔(𝑄) but also the cost of updating 𝑓, which is the main multiplication in Miller’s algorithm as a multiplication in 𝔽_𝑞𝑘. Consider 𝔽_𝑞𝑘 as an 𝔽_𝑞𝑘/4-vector space with bases 1, 𝛿, 𝛿², and 𝛿³. Then an arbitrary element 𝛼∈𝔽_𝑞𝑘 can be denoted as 𝑎₀+𝑎₁𝛿+𝑎₂𝛿²+𝑎₃𝛿³ with 𝑎_𝑖∈𝔽_𝑞𝑘/4, 𝑖=0,1,2,3. And the reduced value of 𝑔(𝑄) we have gotten above can be denoted as 𝛽=𝑏₀+𝑏₂𝛿²+𝑏₃𝛿³, where 𝑏₃∈𝔽_𝑞 and 𝑏₀,𝑏₂∈𝔽_𝑞𝑘/4. When using the Schoolbook method, multiplying 𝛼 by 𝛽 costs 4⋅(𝑘/4)𝐦 for computing 𝑎_𝑖⋅𝑏₃, 𝑖=0,1,2,3 and costs 8(𝑘/4)²𝐦 for 𝑎_𝑖⋅𝑏₀ and 𝑎_𝑖⋅𝑏₂. The total cost (𝑘²/2+𝑘)𝐦 equals to ((1/2)+(1/𝑘))𝐌, considering that a general multiplication in 𝔽_𝑞𝑘 costs 𝐌=𝑘²𝐦. Namely, the quartic twist may reduce the cost of the main multiplication in Miller’s algorithm to ((1/2)+(1/𝑘))𝐌.

Therefore, the addition step costs ((1/2)+(1/𝑘))𝐌+((𝑘/2)+14)𝐦+1𝐦_𝐜, where 1𝐦_𝐜 is constant multiplication by 𝑎. For a mixed addition step, the costs reduce to ((1/2)+(1/𝑘))𝐌+((𝑘/2)+12)𝐦+1𝐦_𝐜.

The doubling step costs ((1/2)+(1/𝑘))𝐌+1𝐒+((𝑘/2)+4)𝐦+7𝐬+2𝐦_𝐜, where 2𝐦_𝐜 are constant multiplications by 𝑎 and 𝑑.

6.2. Edwards Curves with 𝑗=0

The twisted Edwards curve 𝑎𝑥²+𝑦²=1+𝑑𝑥²𝑦² has 𝑗-invariant 𝑗_𝑎,𝑑=16(𝑎²+14𝑎𝑑+𝑑²)³/𝑎𝑑(𝑎−𝑑)⁴; hence, 𝑗_𝑎,𝑑=0 if and only if 𝑎=(−7±4√3)𝑑. Note that 3 is a square in finite field 𝔽_𝑞 if and only if 𝑞≡±1(mod12). Now we assume that 𝑞≡±1(mod12) and 𝑎, 𝑑 satisfy the relation 𝑎=(−7±4√3)𝑑. Then Edwards curve 𝐸_𝑎,𝑑∶𝑎𝑥²+𝑦²=1+𝑑𝑥²𝑦² has 𝑗-invariant equal to 0; hence, there exist twists of degree 6. The case 𝑎=1 is the Edwards curve 𝑥²+𝑦²=1−(7+4√3)𝑥²𝑦² with complex multiplication 𝐷=−3 [20].

We denote that 𝑀=2(𝑎+𝑑)/(𝑎−𝑑) and 𝑁=4/(𝑎−𝑑) when given 𝑎,𝑑.

Lemma 3. Assume that 6∣𝑘, 𝛿 is a generator of 𝔽_𝑞𝑘 over 𝔽_𝑞𝑘/6 with 𝛿⁶∈𝔽_𝑞𝑘/6, which implies 𝛿²∈𝔽_𝑞𝑘/2 and 𝛿³∈𝔽_𝑞𝑘/3. Then the Weierstrass elliptic curve 𝑊_𝑀𝑁∶𝑣²=𝑢³−𝑀³𝑁³𝛿27⁶ (27) is a twist of degree 6 over 𝔽_𝑞𝑘/6 of 𝐸_𝑎,𝑑. The isomorphism can be given as 𝜓∶𝑊_𝑎⟶𝐸_𝑎,𝑑,()⟼=𝑢,𝑣𝑥,𝑦𝑁𝛿3𝑢−𝑀𝑁𝛿²,3𝑣3𝑢−𝑀𝑁𝛿²−3𝑁𝛿²3𝑢−𝑀𝑁𝛿²+3𝑁𝛿². (28)

Proof. Firstly, we check that 𝜓 is well defined; that is, 𝜓(𝑢,𝑣)∈𝐸_𝑎,𝑑. We denote that 𝑢^′=𝑢−(𝑀𝑁𝛿²)/3, then 𝑣²=𝑢³−𝑀³𝑁³𝛿⁶27=𝑢^′𝑢^′2+𝑀𝑁𝛿²𝑢^′+𝑀²𝑁²𝛿⁴3,𝑥=𝑁𝛿𝑢^′𝑣𝑢,𝑦=^′−𝑁𝛿²𝑢^′+𝑁𝛿². (29) Note that 1𝑥²=𝑣²𝑁²𝛿²𝑢^′2=1𝑁²𝛿²𝑢^′𝑢^′2+𝑀𝑁𝛿²𝑢^′+𝑀²𝑁²𝛿⁴3. (30) Since 𝑀−𝑁𝑎=−2, 𝑀−𝑁𝑑=2, and 𝑀²=3, we have 1𝑥²1−𝑎=𝑁²𝛿²𝑢^′𝑢^′−𝑁𝛿²²,1𝑥²1−𝑑=𝑁²𝛿²𝑢^′𝑢^′+𝑁𝛿²². (31) Thus 1−𝑎𝑥²1−𝑑𝑥²=𝑢^′−𝑁𝛿²𝑢^′+𝑁𝛿²²=𝑦²,thatis,𝑎𝑥²+𝑦²=1+𝑑𝑥²𝑦². (32)
Moreover, it can be easily checked that 𝜓 is invertible and satisfies 𝜓(𝑂)=𝑂; that is, 𝜓 is an isomorphism. Besides, the minimal field that 𝜓 can be defined over is 𝔽_𝑞𝑘 which has degree 6 over 𝔽_𝑞𝑘/6. Hence, the twist degree is 6.

For 𝑄^′∈𝑊_𝑀𝑁(𝔽_𝑞𝑘/6), we have (𝑥_𝑄,𝑦_𝑄)=𝜓(𝑄^′)∈𝐸_𝑎,𝑑(𝔽_𝑞𝑘). Then its corresponding point 𝑄∈𝑆𝑊_𝑎,𝑑(𝔽_𝑞𝑘) can be given as (𝑋_𝑄∶𝑌_𝑄∶𝑊_𝑄∶𝑍_𝑄)=(𝑥_𝑄∶𝑦_𝑄∶𝑥_𝑄𝑦_𝑄∶1). One can check by substitution that 𝑋_𝑄+𝑊_𝑄𝑌_𝑄+𝑍_𝑄=𝑥_𝑄=𝑁𝑢𝑣𝛿−𝑀𝑁²𝛿3𝑣³,𝑋_𝑄−𝑊_𝑄𝑌_𝑄+𝑍_𝑄=𝑥_𝑄⋅1−𝑦_𝑄1+𝑦_𝑄=𝑁²𝑣𝛿³. (33) For 𝜃=(𝑁𝑢/2𝑣)𝛿⁶ and 𝜂=(𝑁²/6𝑣)𝛿⁶, we have 𝑋_𝑄𝑌_𝑄+𝑍_𝑄=𝜃𝛿⁻⁵+(3−𝑀)𝜂𝛿⁻³,𝑊_𝑄𝑌_𝑄+𝑍_𝑄=𝜃𝛿⁻⁵−(3+𝑀)𝜂𝛿⁻³ (34) with 𝜃,𝜂∈𝔽_𝑞𝑘/6. Then for the evaluation of 𝑔_𝑃1,𝑃2(𝑄) with 𝑃₃=𝑃₁+𝑃₂≠𝑂, 𝑂^′, we get 𝑔_𝑃1,𝑃2(𝑄)=Π_{𝑃1,𝑃2,𝑂′}(𝑄)Π_{𝑃3,𝑂,𝑂′}(𝑄)=𝐶_𝑋𝑋_𝑄+𝐶_𝑌𝑌_𝑄+𝑍_𝑄+𝐶_𝑊𝑊_𝑄𝑊₃𝑋_𝑄−𝑋₃𝑊_𝑄=𝐶_𝑋𝑋_𝑄/𝑌_𝑄+𝑍_𝑄+𝐶_𝑌+𝐶_𝑊𝑊_𝑄/𝑌_𝑄+𝑍_𝑄𝑊₃𝑋_𝑄/𝑌_𝑄+𝑍_𝑄−𝑋₃𝑊_𝑄/𝑌_𝑄+𝑍_𝑄=𝐶_𝑋𝜃𝛿⁻⁵+(3−𝑀)𝜂𝛿⁻³+𝐶_𝑌+𝐶_𝑊𝜃𝛿⁻⁵−(3+𝑀)𝜂𝛿⁻³×𝑊₃𝜃𝛿⁻⁵+(3−𝑀)𝜂𝛿⁻³−𝑋₃𝜃𝛿⁻⁵−(3+𝑀)𝜂𝛿⁻³⁻¹=𝐶_𝑋+𝐶_𝑊𝜃+3𝐶_𝑋−𝐶_𝑊−𝑀𝐶_𝑋+𝐶_𝑊𝜂𝛿²+𝐶_𝑌𝛿⁵×𝑊₃−𝑋₃𝜃+3𝑊₃+𝑋₃−𝑀𝑊₃−𝑋₃𝜂𝛿²⁻¹∈𝐶_𝑋+𝐶_𝑊𝜃+3𝐶_𝑋−𝐶_𝑊−𝑀𝐶_𝑋+𝐶_𝑊𝜂𝛿²+𝐶_𝑌𝛿⁵𝔽^∗_𝑞𝑘/2. (35)

So we can reduce 𝑔_𝑃1,𝑃2(𝑄) to the representative in the last line. Moreover we may precompute 𝜃 and 𝜂 since they are fixed during the whole computation. When 𝐶_𝑋,𝐶_𝑌,𝐶_𝑊∈𝔽_𝑞, and 𝜃, 𝜂∈𝔽_𝑞𝑘/6 are given, the evaluation at 𝑄 can be computed in (𝑘/3)𝐦+𝐦_𝐜, with (𝑘/6)𝐦 each for multiplications by 𝜃 and 𝜂 and a constant multiplication by 𝑀=2(𝑎+𝑑)/(𝑎−𝑑).

Similarly with the 𝑗=1728 case, consider 𝔽_𝑞𝑘 as an 𝔽_𝑞𝑘/6-vector space with bases 1,𝛿,𝛿²,…,𝛿⁵. Then an arbitrary element 𝛼∈𝔽_𝑞𝑘 can be denoted as 𝑎₀+𝑎₁𝛿+𝑎₂𝛿²+⋯+𝑎₅𝛿⁵ with 𝑎_𝑖∈𝔽_𝑞𝑘/6, 𝑖=0,1,…,5. And the reduced 𝑔(𝑄) we have gotten above can be denoted as 𝛽=𝑏₀+𝑏₂𝛿²+𝑏₅𝛿⁵, where 𝑏₅∈𝔽_𝑞 and 𝑏₀,𝑏₂∈𝔽_𝑞𝑘/6. When using the Schoolbook method, multiplying 𝛼 by 𝛽 costs 6⋅(𝑘/6)𝐦 for computing 𝑎_𝑖⋅𝑏₅, 𝑖=0,1,2,3 and costs 12(𝑘/6)²𝐦 for 𝑎_𝑖⋅𝑏₀ and 𝑎_𝑖⋅𝑏₂. The total cost ((𝑘²/3)+𝑘)𝐦 equals to ((1/3)+(1/𝑘))𝐌, considering that a general multiplication in 𝔽_𝑞𝑘 costs 𝐌=𝑘²𝐦. Namely, the sextic twist may reduce the cost of the main multiplication in Miller’s algorithm to ((1/3)+(1/𝑘))𝐌.

Therefore, the addition step costs ((1/3)+(1/𝑘))𝐌+((𝑘/3)+14)𝐦+2𝐦_𝐜, where 2𝐦_𝐜 are multiplications by 𝑎 and 2(𝑎+𝑑)/(𝑎−𝑑). For a mixed addition step, the costs reduce to ((1/3)+(1/𝑘))𝐌+((𝑘/3)+12)𝐦+2𝐦_𝐜.

The doubling step costs ((1/3)+(1/𝑘))𝐌+1𝐒+((𝑘/3)+4)𝐦+7𝐬+3𝐦_𝐜, where 3𝐦_𝐜 are multiplications by 𝑎, 𝑑, and 2(𝑎+𝑑)/(𝑎−𝑑).

Table 1 shows the concrete comparison for doubling step (DBL), mixed addition step (mADD), and addition step (ADD).

Table 1 

7. Conclusion

In this paper, we propose an elaborate geometry approach to explain the group law on Edwards curves which are seen as the intersection of two quadric surfaces in space. Using the geometric interpretation of the group law, we obtain the Miller function of Tate pairing computation on twisted Edwards curves. Then we present the explicit formulae for pairing computation on twisted Edwards curves. The doubling step of our formulae is a little faster than that in [4]. Finally, to improve the efficiency, we present quartic and sextic twists on twisted Edwards curves. By using high twists, the costs of substituting in 𝑗=1728 case and 𝑗=0 case can be reduced to a half and a third, respectively. Above all, it is interesting to consider more efficient formulae for pairing computation on twist Edwards curves.

Acknowledgments

This work was supported by National Natural Science Foundation of China (no. 11101002, no. 11271129, and no. 61370187) and Beijing Natural Science Foundation (no. 1132009).