Delaying Mismatched Field Multiplications in Pairing Computations

Miller’s algorithm for computing pairings involves performing multiplications between elements that belong to different finite fields. Namely, elements in the full extension field Fpk">Fpk are multiplied by elements contained in proper subfields Fpk/d">Fp(k/${{\mathrm{d)}}^{}}_{}$, and by elements in the base field Fp">${\mathbb{F}}_p$. We show that significant speedups in pairing computations can be achieved by delaying these “mismatched” multiplications for an optimal number of iterations. Importantly, we show that our technique can be easily integrated into traditional pairing algorithms; implementers can exploit the computational savings herein by applying only minor changes to existing pairing code.