A Variant of Miller’s Formula and Algorithm

John Boxall 1 Nadia El Mrabet 2 Fabien Laguillaumie 3 Duc-Phong Le 4
2 liasd
LIASD - Laboratoire d'Informatique Avancée de Saint-Denis
3 Equipe AMACC - Laboratoire GREYC - UMR6072
GREYC - Groupe de Recherche en Informatique, Image, Automatique et Instrumentation de Caen
Abstract : Miller's algorithm is at the heart of all pairing-based cryp-tosystems since it is used in the computation of pairing such as that of Weil or Tate and their variants. Most of the optimizations of this al-gorithm involve elliptic curves of particular forms, or curves with even embedding degree, or having an equation of a special form. Other im-provements involve a reduction of the number of iterations. In this article, we propose a variant of Miller's formula which gives rise to a generically faster algorithm for any pairing friendly curve. Concretely, it provides an improvement in cases little studied until now, in particular when denominator elimination is not available. It allows for instance the use of elliptic curve with embedding degree not of the form 2 i 3 j , and is suitable for the computation of optimal pairings. We also present a version with denominator elimination for even embedding degree. In our implementations, our variant saves between 10% and 40% in running time in comparison with the usual version of Miller's algorithm without any optimization.
Complete list of metadatas

Cited literature [26 references]  Display  Hide  Download

Contributor : Greyc Référent <>
Submitted on : Monday, November 17, 2014 - 11:09:55 AM
Last modification on : Friday, June 28, 2019 - 4:38:51 PM
Long-term archiving on : Friday, April 14, 2017 - 3:58:01 PM


Files produced by the author(s)



John Boxall, Nadia El Mrabet, Fabien Laguillaumie, Duc-Phong Le. A Variant of Miller’s Formula and Algorithm. Proceedings of Pairing 2010, Dec 2010, Ishikawa, Japan. pp.417 - 434, ⟨10.1007/978-3-642-17455-1_26⟩. ⟨hal-01083368⟩



Record views


Files downloads