On Compressible Pairings and Their Computation

In this paper we provide explicit formulæ to compute bilinear pairings in compressed form, and indicate families of curves where particularly generalised versions of the Eta and Ate pairings due to Zhao et al. are especially efficient. With the new formulæ it is possible to entirely avoid F pk arithmetic during pairing computation on elliptic curves over Fp with even embedding degree k. Using our new method all intermediate results in the Miller loop are represented by just one F pk/2 element and manipulated in compressed form. For certain families of ordinary curves with embedding degree k = 6m all arithmetic can be done in a subfield of size p and the representation can be further compressed to two Fpm elements.