An Improvement of Algorithm for Computing Final Exponentiation for Pairing on KSS36 Curve and its Implementation

Pairing is a bilinear map using two rational points on an elliptic curve and consists of two steps: Miller's algorithm and Final exponentiation. The Final exponentiation is an exponentiation step on an extension field, which can be decomposed into Easy and Hard parts. Since the Hard part requires more computational costs than the Easy part, the decomposition method and calculation procedure of it greatly affects the performance of the Final exponentiation. In previous studies, several methods have been proposed for decomposing the Hard part, including p-adic expansion method, lattice-based method and method using the logical algorithm. There are also known methods to search for the optimal calculation procedure, such as using addition chains or finding relations that allow reusing the calculation results. For the pairing on the KSS36 curve, p-adic expansion is proposed by Guzmán- Trampe et al. On the other hand, the authors propose a more efficient algorithm using a lattice-based method on the KSS36 curve at a 256-bit security level. The authors also implemented the algorithm, leading to a 1.68 % reduction in the execution time of the Final exponentiation from the previous one.