Identity-Based Encryption Protocols Using Bilinear Pairing

the best result. In [57] the authors suggested to take the so called simplified Jacobian-
Chudnovsky coordinate J s as they store (X, Y, Z, Z 2 ) instead of (X, Y, Z). However, we have
found out that if one encapsulates EC addition/doubling with line computation then there
is no need to additionally store Z 2 – one can simply work in the Jacobian coordinate. Here
we give the explicit formulae required for the encapsulated computation of double/add-andline
computation. In what follows, by [M] and [S], we respectively denote the cost of one
multiplication and one squaring in IF p .
4.3.1 Encapsulated Point Doubling and Line Computation
Here P = (X 1 , Y 1 , Z 1 ) correspond to (X 1 /Z 2 1, Y 1 /Z 3 1) in affine coordinate. We encapsulate the
computation of 2P given P together with the computation corresponding to the associated
line.
Point Doubling : From the EC point doubling rule we have the following formula:
Using temporary variables, we compute:
X 3 ′ = (3X2 1 + aZ1) 4 2 − 8X 1 Y1
2
4Y1 2 Z1
2
Y 3 ′ = 3X2 1 + aZ1
4 ( X 1
2Y 1 Z 1 Z1
2 − X 3) ′ − Y 1
Z1
3
X 3 = (3X1 2 + aZ1) 4 2 − 8X 1 Y1
2
Y 3 = (3X1 2 + aZ1)(4X 4 1 Y1 2 − X 3 ) − 8Y1
4
Z 3 = 2Y 1 Z 1
1. t 1 = Y1 2 ; 2. t 2 = 4X 1 t 1 ; 3. t 3 = 8t 2 1;
4. t 4 = Z1; 2 5. t 5 = 3X1 2 + aZ1; 4 6. X 3 = t 2 5 − 2t 2 ;
7. Y 3 = t 5 (t 2 − X 3 ) − t 3 ; 8. Z 3 = 2Y 1 Z 1 .
So, we require 6[S] + 4[M] for EC doubling. Now consider t 5 . If a is a general element of
IF p , then we have to count the multiplication a × (Z 4 1). However, if a is small, i.e., it can be
represented using only a few (say ≤ 8) bits, then we do not count this multiplication. In this
case, aZ 4 1 can be obtained summing Z 4 1 a total of a times. This reduces the operation count
to 6[S]+3[M]. Further, if a = −3, then t 5 = 3(X 1 − Z 2 1)(X 1 + Z 2 1) = 3(X 1 − t 4 )(X 1 + t 4 ) and
the operation count reduces to 4[S]+4[M]. These facts are known and can be found in [53].
Line Computation: Note that, the slope µ of h P,P , the line through P and −2P , is
µ = t 5 /Z 3 . So,
h P,P (x, y) = (y − Y 1
Z 3 1
Hence, h P,P (−x Q , iy Q ) = (y Q i − Y 1
) + µ(x
Z1
3 Q + X 1
).
Z1
2
By defining g P,P (x, y) = (2Y 1 Z1)h 3 P,P (x, y), we get,
) − µ(x − X 1
).
Z1
2
g P,P (−x Q , iy Q ) = (2Y 1 Z 1 )Z1y 2 Q i − 2Y1 2 + (3X1 2 + aZ1)(Z 4 1x 2 Q + X 1 )
= Z 3 t 4 y Q i − (2t 1 − t 5 (t 4 x Q + X 1 ))
40