Identity-Based Encryption Protocols Using Bilinear Pairing

Thus, for parallel version of pairing computation algorithm, one obtains optimal twomultiplier
algorithms for both doubling and addition. For doubling, the four multiplier
algorithm is optimal, while for addition, the four multiplier algorithm is sub-optimal. However,
the Hamming weight of r will be small and hence if we use four multipliers then the
sub-optimal performance will be amortized over the length of the representation of r and
will not be significantly reflected in the final cost analysis.
4.5 Comparison
For the purpose of comparison, we assume that r = (r t = 1, r t−1 , . . . , r 0 ) is represented in
NAF having length t and Hamming weight s.
The irrelevant denominator optimisation was introduced in [8]. Further, [8] uses affine
representation. The total cost including point/line computation and updation is
t(1[I]+8[M]+2[S]) + s(1[I]+6[M]+1[S]),
where [I] is the cost of inversion over IF p and is at least 30[M], see [72].
Izu-Takagi [57] uses projective coordinates for pairing computation in general characteristics
for large embedding degree k. They also consider the BKLS optimisations for
supersingular curves with embedding degree k = 2 for general a. They assume that one IF p k
multiplication takes k 2 [M]. For k = 2, this can be improved to 3[M]. In the following calculation,
we use this fact. Their cost for w-iterated doubling is 6w[M]+4w[S]+13w[M]+(5w+1)[S]
and addition is 6[M]+16[M]+3[S]. Summing over w’s, the total cost comes to
t(19[M]+9[S])+s(22[M]+4[S]).
The work of Scott [82] also proposes the use of projective coordinates in the case a = −3
for certain non-supersingular curves. The paper does not distinguish between multiplication
and squaring. The total cost is 21t[M]+22s[M].
In Table 4.1, we summarize the above costs along with the costs obtained by our algorithms
for the various cases for the curve parameter a. The best case occurs for Algorithm 1
with a = −3. Also the cases for Algorithm 1 for small a and Algorithm 2 are marginally
slower than the best case. However, all three of these cases are much more efficient than
any of the previous algorithms. The algorithms of Izu-Takagi [57] and Scott [82] are more
efficient than the basic BKLS algorithm with affine coordinates.
For Tate pairing applications, r is generally chosen so that the Hamming weight s is
small. On the other hand, for a general r, the Hamming weight s is approximately s = t/3.
In either of these two situations, we summarize the superiority of our method as follows.
• Algorithm 1 with a = −3 is approximately 20% faster compared to the algorithm by
Scott.
• Algorithm 2 is approximately 33% faster compared to the algorithm by Izu and Takagi.
47