Computing Optimal 2-3 Chains for Pairings

  • Alex Capuñay
  • Nicolas Thériault
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9230)


Using double-base chains to represent integers, in particular chains with bases 2 and 3, can be beneficial to the efficiency of scalar multiplication and the computation of bilinear pairings via (a variation of) Miller’s algorithm. For one-time scalar multiplication, finding an optimal 2-3 chain could easily be more expensive than the scalar multiplication itself, and the associated risk of side-channel attacks based on the difference between doubling and tripling operations can produce serious complications to the use of 2-3 chains.

The situation changes when the scalar is fixed and public, as in the case of pairing computations. In such a situation, performing some extra work to obtain a chain that minimizes the cost associated to the scalar multiplication can be justified as the result may be re-used a large number of times. Even though this computation can be considered “attenuated” over several hundreds or thousands of scalar multiplications, it should still remain within the realm of “practical computations”, and ideally be as efficient as possible.

An exhaustive search is clearly out of the question as its complexity grows exponentially in the size of the scalar. Up to now, the best practical approaches consisted in obtaining an approximation of the optimal chain via a greedy algorithm, or using the tree-based approach of Doche and Habsieger, but these offer no guarantee on how good the approximation will be. In this paper, we show how to find the optimal 2-3 chain in polynomial time, which leads to faster pairing computations. We also introduce the notion of “negative” 2-3 chains, where all the terms (except the leading one) are negative, which can provide near-optimal performance but reduces the types of operations used (reducing code size for the pairing implementation).


Integer representations Double-base chains Tate pairings 



The authors would like to thanks the anonymous referees for their useful comments and suggestions.


  1. 1.
    Aranha, D.F., Karabina, K., Longa, P., Gebotys, C.H., López, J.: Faster explicit formulas for computing pairings over ordinary curves. In: Paterson, K.G. (ed.) EUROCRYPT 2011. LNCS, vol. 6632, pp. 48–68. Springer, Heidelberg (2011) CrossRefGoogle Scholar
  2. 2.
    Barreto, P.S.L.M., Kim, H.Y., Lynn, B., Scott, M.: Efficient algorithms for pairing-based cryptosystems. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 354–369. Springer, Heidelberg (2002) CrossRefGoogle Scholar
  3. 3.
    Blake, I.F., Murty, V.K., Xu, G.: Refinements of Miller’s algorithm for computing the weil/tate pairing. J. Algorithms 58, 134–149 (2006)zbMATHMathSciNetCrossRefGoogle Scholar
  4. 4.
    Blake, I.F., Seroussi, G., Smart, N.P.: Advances in Elliptic Curve Cryptography. London Mathematical Society Lecture Note Series, vol. 317. Cambridge University Press, Cambridge (2005) zbMATHCrossRefGoogle Scholar
  5. 5.
    Bernstein, D.J., Birkner, P., Lange, T., Peters, C.: Optimizing double-base elliptic-curve single-scalar multiplication. In: Srinathan, K., Rangan, C.P., Yung, M. (eds.) INDOCRYPT 2007. LNCS, vol. 4859, pp. 167–182. Springer, Heidelberg (2007) CrossRefGoogle Scholar
  6. 6.
    A. Capuñay. Multibase Scalar Multiplications in Cryptographic Pairings. preprint, 2015Google Scholar
  7. 7.
    Ciet, M., Joye, M., Lauter, K., Montgomery, P.L.: Trading inversions for multiplications in elliptic curve cryptography. Des. Codes Crypt. 39(2), 189–206 (2006)zbMATHMathSciNetCrossRefGoogle Scholar
  8. 8.
    Dimitrov, V.S., Imbert, L., Mishra, P.K.: Efficient and secure elliptic curve point multiplication using double-base chains. In: Roy, B. (ed.) ASIACRYPT 2005. LNCS, vol. 3788, pp. 59–78. Springer, Heidelberg (2005) CrossRefGoogle Scholar
  9. 9.
    Dimitrov, V.S., Jullien, G.A., Miller, W.C.: An algorithm for modular exponentiation. Inform. Process. Lett. 66(3), 155–159 (1998)zbMATHMathSciNetCrossRefGoogle Scholar
  10. 10.
    Doche, C., Habsieger, L.: A tree-based approach for computing double-base chains. In: Mu, Y., Susilo, W., Seberry, J. (eds.) ACISP 2008. LNCS, vol. 5107, pp. 433–446. Springer, Heidelberg (2008) CrossRefGoogle Scholar
  11. 11.
    Eisenträger, K., Lauter, K., Montgomery, P.L.: Fast elliptic curve arithmetic and improved weil pairing evaluation. In: Joye, M. (ed.) CT-RSA 2003. LNCS, vol. 2612, pp. 343–354. Springer, Heidelberg (2003) CrossRefGoogle Scholar
  12. 12.
    Miller, V.S.: The Weil pairing, and its efficient calculation. J. Crypt. 17(4), 235–261 (2004)zbMATHCrossRefGoogle Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  1. 1.Departamento de MatemáticasUniversidad de ChileSantiagoChile
  2. 2.Departamento de MatemáticaUniversidad Del Bío-BíoConcepciónChile

Personalised recommendations