Improvement of Miller Loop for a Pairing on FK12 Curve and Evaluation with other STNFS Curves

Abstract

Pairing is carried out by two steps, Miller loop and final exponentiation. In this manuscript, the authors propose an efficient Miller loop for a pairing on the FK12 curve. A Hamming weight and bit-length of loop parameter have a great effect on the computational cost of the Miller loop. Optimal-ate pairing is used as the most efficient pairing on the FK12 curve currently. The loop parameter of optimal-ate pairing is 6z + 2 where z is the integer to make the FK12 curve parameter. Our method uses z which has a shorter bit-length than the previous optimal-ate pairing as the loop parameter. Usually, z has a low Hamming weight to make final exponentiation efficient. Therefore, the loop parameter in our method has a lower Hamming weight than the loop parameter of the previous one in many cases. The authors evaluate our method by the number of multiplications and execution time. As a result, the proposed algorithm leads to a 3.71% reduction in the number of multiplications and a 3.03% reduction in the execution time. In addition, the authors implement other STNFS secure curves and evaluate these curves from viewpoint of execution time.