We present an efficient implementation of $\eta_T$ pairing on Intel Core 2 Duo processor.
The processing speed of our implementation achieves 92 $\mu$sec over ${\mathbb F}_3^{97}$ and 553 $\mu$sec over ${\mathbb F}_3^{193}$ on 2.6GHz processor

MITSUNARI Shigeo

Cryptology ePrint Archive

A Fast Implementation of ηT Pairing inCharacteristic Three on Intel Core 2 DuoProcessorMITSUNARI Shigeo ∗January 14, 2009AbstractWe present an efficient implementation of ηT pairing on Intel Core 2 Duoprocessor. The processing speed of our implementation achieves 92 µsecover F973 and 553 µsec over F1933 on 2.6GHz processor.Keywords: ηT pairing, parallel computing, efficient implementation,SSE1 IntroductionWeil and Tate pairings are important tools for generating many interestingencryption protocols. An ηT pairing proposed by Barreto et al. [1] is one of thefastest pairings over F3m . This paper describes an efficient improvement of theηT pairing algorithm in characteristic three for Intel Core 2 Duo processor.First, we try to improve a multiplication of F3m , which is the most timing-consuming operation in the ηT pairing. We deal with the left-to-right Comb [2]method for the multiplication. The word size parameter for the Comb methodis usually selected to 32 or 64 according to CPU to minimize the number ofaddition and byte shift. Note that a byte shift is faster than an addition usingSSE on Intel Core 2 Duo processor, and moreover a bit shift is very slower than∗Cybozu Labs, Inc.1addition on the same platform. In this paper we therefore modify the left-to-right Comb method to reduce the number of bit shift by increasing the numberof addition.Let A, B be an m-degree polynomial of F3 [X], and consider a multiplicationC ← A ·B, where the resulting C is an 2m-degree polynomial. The left-to-rightComb method shifts B and adds it to C base on the coefficient of A. In orderto implement a shifting B we require to split B into two registers of word size,which is relatively slow in software implementation. Note that Intel Core 2Duo processor equips an efficient byte rotation (faster than addition). We thenmodify the Comb method to rotate the resulting C instead of B, and then thenumber of slow bit shift operations can be decreased. These modifications makethe speed of multiplication about twice faster.The second improvement is to deploy the two cores of Intel Core 2 Duoprocessor. The Duursma-Lee loop of the ηT pairing has an auxiliary variabledepending on the previous computed variables. However we can split Duursma-Lee loop into two loops of half size by precomputing the sequence of cubes(and cube roots) of input variables. Then Intel Core 2 Duo processor cansimultaneously compute each half loop respectively, and the time of Duursma-Lee loop without the final exponentiation can be improved by twice.We implemented the ηT pairing according these improvements and the speedachieves 92 µsec over F973 and 553 µsec over F1933 on 2.6GHz Intel Core 2 Duo pro-cessor. The timing is about four times faster than that of [5], which is the fastestto the best of our knowledge. The full source code of our implementation isavailable from http://homepage1.nifty.com/herumi/crypt/pairing.html.2 Modified Comb method for SSEFinite field F3m is the set of all polynomials represented by F3m = F3[X]/f(X),where f(X) is an irreducible polynomial in F3 [X] of degree m. We select f(x) =x97 + x12 + 2 for m = 97 and f(x) = x193 + x12 + 2 for m = 193. An elementA(x) ∈ F3m can be represented asA(x) = (am−1, am−2, · · · , a1, a0), ai ∈ F3 for all i = 0, 1, · · · ,m− 1.2Let w a word size of CPU (or its divisor), and b be a width size for the precom-puted window. Here, we define an element Ãi(x) of F3m as follows:Ãi(x) = (0, · · · , 0, amin(i+b−1,(ceil(i/w)+1)w−1), · · · , ai+1, ai).For example, let w = 32 and b = 3, thenÃ0(x) = a2x2 + a1x + a0,Ã27(x) = a29x2 + a28x + a27,Ã30(x) = a31x + a30,Ã32(x) = a34x2 + a33x + a32.Algorithm 1 is the left-to-right Comb Method in F3m [2]. Here tbl[T (x)] is aprecomputed table, which consists of A(x)T (x) for all polynomials T (x) ∈ F3mof degree < b.Algorithm 1 : Left-to-right Comb method with window of width b[2]input: A(x), B(x) ∈ F3moutput: C(x)← A(x)B(x)1. Compute tbl[T (x)]← A(x)T (x) for all T (x) ∈ F3m of degree < b2. n1 ← ceil(w/b)n2 ← ceil(m/w)3. C(x)← 04. for i← 0 to n1 − 1 do5. for j ← 0 to n2 − 1 do6. C(x)← C(x) + tbl[B̃iw+j(x)]xjw7. end for8. if j ̸= n1 − 1 then C(x)← C(x)xb9. end forFrom our experiment, the most efficient implementation of Algorithm 1 onIntel Core 2 Duo processor is to choose b = 3 for m = 97 and m = 193, and thuswe fix b = 3 in the following. In Step 6 we load a part of precomputed tabletbl[T (x)] based on the information of T (x) = B̃iw+j(x). We show the numberof operations of bit shift and addition in Table 1 at Algorithm 1. Comput-ing tbl[B̃iw+j(x)]xjw requires (w/8)-byte shift operation and C(x) ← C(x)xbrequires b-bit shift.Ordinary, we select w = 32 or 64 because the number of addition is mini-mum. But, Intel Core 2 Duo processor has 128-bits SSE registers and palignrmnemonics which reduces the cost of byte shift among SSE registers.Acoording to the number of mnemonics of bit/byte shift of temporary 2m-bit data and addition in Table 2, 2m-bit shift is very slow, then we selectedw = 8 to reduce the operation.3Table 1: The number of mnemonics except for move in Algorithm 1m = 97 m = 193w bit shift add and byte shift bit shift add and byte shift8 2 36 2 7216 5 36 5 7232 10 33 10 66Table 2: The number of mnemonics of operation except for moving by SSEm byte shift byte rotation bit shift addition in F3m97 4 4 16 6193 6 6 30 12Next, to implement an addition between 2m-bit data and m-bit data inAlgorithm 1 requires to split m-bit data into two data and then the number ofaddtion increases.Because byte rotation is faster than addition according to Table 2 on IntelCore 2 Duo processor, we modify Algorithm 1 as Algorithm 2 to avoid splittingdata. Moreover, by connecting byte shift and bit shift at l.9–10 in Algorithm 2,the cost can be more reduced.3 Parallel computation of loopWe show the main loop of ηT pairing proposed Barreto et al. [1] at Algorithm3. Because xp and yp are not dependent on f and g, then we can compute thesequence of cubes and cube roots before computing the loop. And then, we cansplit the remain loop into two loops of half size (the first half and the latterhalf). We show the modified algorithm at Algorithm 4.Because the loops of l.2 and l.3, l.8–12 and l.13–17 in Algorithm 4 are in-dependent from each other respectively, then Intel Core 2 Duo processor cansimultaneously compute each loop respectively.4 Results and comparisonsWe implemented the ηT pairing according to these improvements and show ourtiming at Table 3 and compare them with Table 1 [4] for m = 97(using SSE)and with Table 6 [5] for m = 193. Our timing(single) means the score by onecore and our timing(multi) by two cores. Our timing(multi) is about four timesfaster even if considering the difference of frequency among CPUs.4Algorithm 2 : Modified left-to-right Comb method for SSEinput: A(x), B(x) ∈ F3moutput: C(x)← A(x)B(x)1. Compute tbl[T (x)]← A(x)T (x) for all T (x) ∈ F3m of degree < b2. n1 ← ceil(w/b) where w = 8n2 ← ceil(m/w)3. C(x)← 04. for i← 0 to n1 − 1 do5. for j ← 0 to n2 − 1 do6. C(x)← C(x) + tbl[B̃iw+j(x)]7. C(x)← w-bit right rotation of C(x)8. end for9. C(x)← wn2-bit left rotation of C(x)10. if j ̸= n1 − 1 then C(x)← C(x)xb11. end forAlgorithm 3 : main loop of ηT pairing[1]xp, yp, xq, yq ∈ E(F3m)[l ]; the l-torsion subgroup of E(F3m)f , g ∈ F36m , σ2 = −1, ρ3 = ρ + 11. for i← 0 to m−12do2. u← xp + xq + 13. g ← ypyqσ − u2 − uρ− ρ24. f ← fg5. xp ← x1/3p , yp ← y1/3p , xq ← x3q, yq ← y3q6. end forAlgorithm 4 : modified loop for parallel computationxp[0]← xp, yp[0]← yp, xq[0]← xq, yq[0]← yq1. for i← 0 to m+12− 1 do2. xp[i + 1]← xp[i]1/3, xq[i + 1]← xq[i]33. yp[i + 1]← yp[i]1/3, yq[i + 1]← yq[i]34. end for5. n← m+12, f1 ← f6. u← xp[n/2] + xq[n/2] + 17. f2 ← yp[n/2]yq[n/2]σ − u2 − uρ− ρ28. for i← 0 to n/2− 1 do9. u← xp[i] + xq[i] + 110. g ← yp[i]yq[i]σ − u2 − uρ− ρ211. f1 ← f1g12. end for13. for i← n/2 + 1 to n− 1 do14. u← xp[i] + xq[i] + 115. g ← yp[i]yq[i]σ − u2 − uρ− ρ216. f2 ← f1g17. end for18. f ← f1f25Table 3: Running times for multiplication and ηT pairing(µsec)m 97 193mul pairing mul pairing[4](m = 97), [5](m = 193)1 0.500 479.63 1.822 2611our timing(single)2 0.181 149 0.624 975our timing(multi)2 0.181 92 0.624 5531AMD Opteron 275 (2.2GHz), gcc 4.1.2 using Linux x86 (64-bit)2Intel Core 2 Duo (2.6GHz), Visual Studio 2008 SP1 using Windows Xp (32-bit)5 AcknowledgmentThe authors would like to thank Takagi Tsuyoshi, Jean-Luc Beuchat and EijiOkamoto for their valuable comments.References[1] P. Barreto, S. Galbraith, C. Ó hÉigeartaigh and M. Scott, “Efficient pairingcomputation on supersingular abelian varieties.” Designs, Codes and Cryp-tography 42(3), pp.239–271, 2007.[2] D. Hankerson, A. Menezes and S. Vanstone, “Guide to elliptic curve cryp-tography,” Springer-Verlag, 2004.[3] M. Yoshitomi, T. Takagi, S. Kiyomoto, and T. Tanaka, “Efficient Imple-mentation of the Pairing on Mobilephones using BREW,” 20 Aug 2007(http://eprint.iacr.org/2007/340).[4] M. Shirase, Y. Kawahara, T. Takagi, E. Okamoto, “Universal ηT Pairing Al-gorithm over Arbitrary Extension Degree,” The 8th International Workshopon Information Security Applications, WISA 2007, LNCS 4867, pp.1–15,Springer-Verlag, 2007.[5] Y. Kawahara, K. Aoki, and T. Takagi, “Faster Implementation of ηT Pairingover GF(3m) Using Minimum Number of Logical Instructions for GF(3)-Addition,” Pairing 2008, LNCS 5209, pp.282–296, 2008.6

A Fast Implementation of $\eta_T$ Pairing in Characteristic Three on Intel Core 2 Duo Processor

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive

A Fast Implementation of ηT\eta_TηT​ Pairing in Characteristic Three on Intel Core 2 Duo Processor

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive

A Fast Implementation of $\eta_T$ Pairing in Characteristic Three on Intel Core 2 Duo Processor