Faster Ate Pairing Computation over Pairing-Friendly Ellipitic Curves Using GLV Decomposition

The preexisting pairings ate, $ate_i$, R-ate, and optimal-ate use q-expansion, where q is the size of the defining field for the elliptic curves. Elliptic curves with small embedding degrees only allow a few of these pairings. In such cases, efficiently computable endomorphisms can be used, as in [11] and [12]. They used the endomorphisms that have characteristic polynomials with very small coefficients, which led to some restrictions in finding various pairing-friendly curves. To construct more pairing-friendly curves, we consider ${\mu}$-expansion using the Gallant-Lambert-Vanstone (GLV) decomposition method, where ${\mu}$ is an arbitrary integer. We illustrate some pairing-friendly curves that provide more efficient pairing from the ${\mu}$-expansion than from the ate pairing. The proposed method can achieve timing results at least 20% faster than the ate pairing.