Identity-Based Encryption Protocols Using Bilinear Pairing

The ultimate result is raised to the power (p 2 − 1)/r, where r|(p + 1) (see Section 4.2.1).
Thus we have to compute
(h P,P (−x Q , iy Q )) (p2 −1)/r
= ((h P,P (−x Q , iy Q )) (p−1) ) (p+1)/r
= ((g P,P (−x Q , iy Q )/(2Y 1 Z 3 1)) (p−1) ) (p+1)/r
= ((g P,P (−x Q , iy Q )) (p−1) ) (p+1)/r .
The last equation holds since (2Y 1 Z 3 1) ∈ IF p and consequently (2Y 1 Z 3 1) p−1 = 1. Thus, we can
work entirely with g P,P (−x Q , iy Q ) instead of h P,P (−x Q , iy Q ). Since t 1 , t 4 and t 5 have already
been computed, g P,P (−x Q , iy Q ) can be obtained using 4 additional multiplications.
Hence, encapsulated point doubling and line computation requires 8[M] + 6[S]. In the case
a is small, this cost is 7[M]+6[S] and for the case a = −3, this cost is 8[M]+4[S].
4.3.2 Encapsulated (Mixed) Point Addition and Line Computation
We encapsulate the computation of P + R given P in affine and R in Jacobian together with
the computation corresponding to the associated line.
Mixed Addition: Given R = (X 1 , Y 1 , Z 1 ) and P = (X, Y, 1) we compute R + P =
(X 3 , Y 3 , Z 3 ) as follows.
X ′ 3 =
( Y −
Y 1
Z1
3
X − X 1
Z 2 1
) 2
− X 1
Z 2 1
− X
=
Y ′
3 =
( ) Y Z
3 2
1 − Y 1
− X 1
− X
(XZ1 2 − X 1 )Z 1 Z1
2 ( )
Y Z
3
1 − Y 1
( X 1
− X
(XZ1 2 − X 1 )Z 1 Z
3) ′ − Y 1
1
2 Z1
3
X 3 = X 3Z ′ 3
= (Y Z1 3 − Y 1 ) 2 − X 1 (XZ1 2 − X 1 ) 2 − X(XZ1 2 − X 1 ) 2 Z1
2
= (Y Z1 3 − Y 1 ) 2 − (XZ1 2 − X 1 ) 2 (X 1 + XZ1)
2
Y 3 = Y 3Z ′
3
= (Y Z1 3 − Y 1 )((XZ1 2 − X 1 ) 2 X 1 − X 3 ) − Y 1 (XZ1 2 − X 1 ) 3
Z 3 = (XZ 2 1 − X 1 )Z 1
Using temporary variables we compute:
1. t 1 = Z1; 2 2. t 2 = Z 1 t 1 ; 3. t 3 = Xt 1 ;
4. t 4 = Y t 2 ; 5. t 5 = t 3 − X 1 ; 6. t 6 = t 4 − Y 1 ;
7. t 7 = t 2 5; 8. t 8 = t 5 t 7 ; 9. t 9 = X 1 t 7 ;
10. X 3 = t 2 6 − (t 8 + 2t 9 ); 11. Y 3 = t 6 (t 9 − X 3 ) − Y 1 t 8 ; 12. Z 3 = Z 1 t 5 .
41