嵌入次数为 $9,15$ 和 $27$ 的椭圆曲线上的最优 Ate 配对
Optimal Ate Pairing on Elliptic Curves with Embedding Degree $9,15$ and $27$
AI总结：
本文针对嵌入次数为 9、15、27 的椭圆曲线，提出最优 Ate 配对的高效计算方法，通过参数选择和格基方法改进 Miller 步与最终幂，在最终幂上分别提升最多 25% 和 29%，且 k=15 曲线在 128 位安全级别优于 BN12 曲线，并用 MAGMA 验证正确性。
摘要：
自基于配对的密码学问世以来，偶数嵌入次数椭圆曲线上配对的高效计算一直备受关注。在奇数嵌入次数的情况下，现有的少数工作仍需改进。本文考虑了嵌入次数 $k=9$、$15$、$27$ 且具有三阶扭曲的椭圆曲线上最优 Ate 配对的计算。我们的主要目标是提供相应扩域的塔式扩域中运算的详细算术和成本估算。通过合理选择参数，与这些情况下已有的少数工作相比，我们能够利用基于格的方法改进 Miller 步和最终幂的理论成本。特别是对于 $k=15$ 和 $k=27$，在最终幂的计算中，我们在基域运算方面分别获得了高达 25% 和 29% 的改进。我们还发现，嵌入次数 $k=15$ 的椭圆曲线在 128 位安全级别下比 BN12 曲线具有更快的性能。我们在每种情况下都提供了 MAGMA 实现，以确保本工作中所用公式的正确性。
英文摘要：
Much attention has been given to the efficient computation of pairings on elliptic curves with even embedding degree since the advent of pairing-based cryptography. The few existing works in the case of odd embedding degrees require some improvements. This paper considers the computation of optimal ate pairings on elliptic curves of embedding degrees $k=9$, $15$, $27$ which have twists of order three. Our main goal is to provide a detailed arithmetic and cost estimation of operations in the tower extensions field of the corresponding extension fields. A good selection of parameters enables us to improve the theoretical cost for the Miller step and the final exponentiation using the lattice-based method as compared to the previous few works that exist in these cases. In particular, for $k=15$, $k=27$, we obtain an improvement, in terms of operations in the base field, of up to 25% and 29% respectively in the computation of the final exponentiation. We also find that elliptic curves with embedding degree $k=15$ present faster results than BN12 curves at the 128-bit security level. We provide a MAGMA implementation in each case to ensure the correctness of the formulas used in this work.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
