In this paper we show that the Ate pairing, originally defined for elliptic curves, generalises to hyperelliptic curves and in fact to arbitrary algebraic curves. It has the following surprising properties: The loop length in Miller’s algorithm can be up to g times shorter than for the Tate pairing, with g the genus of the curve, and the pairing is automatically reduced, i.e. no final exponentiation is needed.
Title
Ate Pairing on Hyperelliptic Curves
Published in
Advances in Cryptology - EUROCRYPT 2007, 26th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Barcelona, Spain, May 20-24, 2007. Proceedings
Series
Lecture Notes in Computer Science, 4515
Pages
430-447
Conference
Advances in Cryptology - EUROCRYPT 2007, Barcelona, Spain, May 20-24, 2007
Date
2007
Publisher
Springer-Verlag Berlin Heidelberg
Record creation date
2016-01-19