Optimal Eta pairing on supersingular genus-2 binary hyperelliptic curves

Diego Aranha (1) , Jean-Luc Beuchat (2) , Jérémie Detrey (3) , Nicolas Estibals (3)

1 IC - Institute of Computing [Campinas]
2 LCIS - Laboratory of Cryptography and Information Security
3 CARAMEL - Cryptology, Arithmetic: Hardware and Software

This article presents a novel optimal pairing over supersingular genus-2 binary hyperelliptic curves. Starting from Vercauteren's work on optimal pairings, we describe how to exploit the action of the 2^{3m}-th power Verschiebung in order to further reduce the loop length of Miller's algorithm compared to the genus-2 Eta-T approach. As a proof of concept, we detail an optimized software implementation and an FPGA accelerator for computing the proposed optimal Eta pairing on a genus-2 hyperelliptic curve over F_{2^{367}} , which satisfies the recommended security level of 128 bits.

Mots clés: Optimal Eta pairing; supersingular genus-2 curve; software implementation; FPGA implementation

Domaines: Cryptographie et sécurité [cs.CR]

Diego Aranha, Jean-Luc Beuchat, Jérémie Detrey, Nicolas Estibals. Optimal Eta pairing on supersingular genus-2 binary hyperelliptic curves. Cryptographer's Track at the RSA Conference 2012 (CT-RSA 2012), Feb 2012, San Francisco, United States. pp.19. ⟨inria-00540002⟩