Efficient algorithm for Tate pairing of composite order

A lot of important cryptographic schemes such as fully secure leakage-resilient encryption and keyword searchable encryption are based on pairings of composite order. Miller's algorithm is used to compute pairings, and the time taken to compute the pairings depends on the cost of calculating the Miller loop. As a way of speeding up calculations of the parings of prime order, the number of iterations of the Miller loop can be reduced by choosing a prime order of low hamming weight. However, it is difficult to choose a particular composite order that can speed up the pairings of composite order. Kobayashi et al. proposed an efficient algorithm for computing Miller's algorithm by using a window method, called Window Miller's algorithm. We can compute scalar multiplication of points on elliptic curves by using a window hybrid binary-ternary form (w-HBTF). In this paper, we propose a Miller's algorithm that uses w-HBTF to compute Tate pairing efficiently. This algorithm needs a precomputation of the points on an elliptic curve and rational functions. The proposed algorithm was implemented in Java on a PC and compared with Window Miller's Algorithm in terms of the time and memory needed to make their precomputed tables. We used the supersingular elliptic curve y² = x³ + x of embedding degree 2 and a composite order of size of 2048 bits. The proposed algorithm with w = 6 = 2·3 was about 12% faster than Window Miller's Algorithm with w = 2 given smallest precomputed tables of the same memory size. Moreover, the proposed algorithm with w = 162 = 2·3⁴ was about 8.5% faster than Window Miller's algorithm with w = 7 on each fastest algorithm.