Identity-Based Encryption Protocols Using Bilinear Pairing

Algorithm 2 (iterated doubling):
Input: P = (α, β, 1) in Jacobian coordinates; Q = (x Q , y Q ).
Output: f P (φ(Q)).
1. Set f = 1; g = 1;
2. X = α; Y = β; Z = 1; set R = (X, Y, Z);
3. for j = s − 1 down to 0
4. (f, R) = EncIdbl(f, R, w j );
5. (g, R) = EncAL(R, l j );
6. f = f × g;
7. end for;
8. return f;
end Algorithm 2.
The Subroutine EncAL has already been discussed in Section 4.4.1. We now describe Subroutine
EncIdbl.
Subroutine EncIdbl
Input: R = (X, Y, Z), f and w.
Output: updated f and 2 w+1 R.
1. t 1 = Y 2 ; t 2 = 4Xt 1 ; t 3 = 8t 2 1; t 4 = Z 2 ; w = aZ 4 ; t 5 = 3X 2 + w;
2. A = −(2t 1 + t 5 (t 4 x Q − X)); X = t 2 5 − 2t 2 ;
Y = t 5 (t 2 − X) − t 3 ; Z = 2Y Z; B = Zt 4 y Q ;
3. f = f 2 × (A + iB);
4. for j = 1 to w do
5. w = 2t 3 w; t 1 = Y 2 ; t 2 = 4Xt 1 ; t 3 = 8t 2 1; t 4 = Z 2 ; t 5 = 3X 2 + w;
6. A = −(2t 1 + t 5 (t 4 x Q − X)); X = t 2 5 − 2t 2 ;
Y = t 5 (t 2 − X) − t 3 ; Z = 2Y Z; B = Zt 4 y Q ;
7. f = f 2 × (A + iB);
8. end for;
9. R = (X, Y, Z);
9. return (f, R);
end Subroutine EncIdbl.
Algorithm 2 is essentially the same as Algorithm 1 except for the use of iterated doubling.
The technique of iterated doubling is considered to reduce computation cost but does not
affect the correctness of the algorithm. We consider the cost of the algorithm. As before let
the Hamming weight of r t−1 , . . . , r 0 be s.
• Steps 5 and 6 of Algorithm 2 are invoked s times. The total cost of these two steps is
s(14[M]+3[S]).
• Step 4 of Algorithm 2 is invoked a total of s times. The cost of the jth invocation of
Step 4 is computed as follows:
– Cost of Steps 3 and 7 in EncIdbl is 5[M].
44