Faster pairing computations on curves with high-degree twists

Abstract

Research on efficient pairing implementation has focussed on
reducing the loop length and on using high-degree twists. Existence of
twists of degree larger than 2 is a very restrictive criterion but luckily
constructions for pairing-friendly elliptic curves with such twists exist.
In fact, Freeman, Scott and Teske showed in their overview paper that
often the best known methods of constructing pairing-friendly elliptic
curves over fields of large prime characteristic produce curves that admit
twists of degree 3, 4 or 6.
A few papers have presented explicit formulas for the doubling and the
addition step in Miller’s algorithm, but the optimizations were all done
for the Tate pairing with degree-2 twists, so the main usage of the high-
degree twists remained incompatible with more efficient formulas.
In this paper we present efficient formulas for curves with twists of degree
2, 3, 4 or 6. These formulas are significantly faster than their predecessors.
We show how these faster formulas can be applied to Tate and ate pairing
variants, thereby speeding up all practical suggestions for efficient pairing
implementations over fields of large characteristic.