##
**The eta pairing revisited.**
*(English)*
Zbl 1189.11057

From the text: Pairings on elliptic curves have, in recent years, become of great research interest in the cryptographic community. This is due to their application in a number of protocols with cryptographic functionality that cannot be achieved using other mathematical primitives.

Traditionally two types of pairings have been considered, the Weil pairing and the Tate pairing. It is now accepted that for general curves providing common levels of security, the Tate pairing is more efficient. However, other related pairings are available which in certain situations are more efficient, for example the Eta-pairing [P. S. L. M. Barreto et al. [Des. Codes Cryptogr. 42, No. 3, 239–271 (2007; Zbl 1142.14307)] on certain supersingular elliptic curves, which in itself extended and optimized the Duursma-Lee techniques introduced in [I. Duursma and H.-S. Lee, Lect. Notes Comput. Sci. 2894, 111–123 (2003; Zbl 1189.11056)].

In this paper we present a new pairing, which is closely related to the Eta pairing but which can be used efficiently with ordinary elliptic curves. In addition we show that for the types of curves for which our new pairing applies, one achieves further performance improvements due to the fact that one can represent the group \(G_2\) (additive group)more efficiently than one can normally.

We call our new pairing the Ate pairing, pronounced eight. This is for two reasons, firstly it is like the Tate pairing, but faster (hence the missing ‘T’), it is also like the Eta pairing but it reverses the order of the arguments (and Ate is Eta spelled backwards).

Much of the results in this paper are based on the use of properties of twists of elliptic curves. Many of the results we use are well known to the experts, but we have been unable to locate them in the literature. Hence, we will also present these results related to twists.

Traditionally two types of pairings have been considered, the Weil pairing and the Tate pairing. It is now accepted that for general curves providing common levels of security, the Tate pairing is more efficient. However, other related pairings are available which in certain situations are more efficient, for example the Eta-pairing [P. S. L. M. Barreto et al. [Des. Codes Cryptogr. 42, No. 3, 239–271 (2007; Zbl 1142.14307)] on certain supersingular elliptic curves, which in itself extended and optimized the Duursma-Lee techniques introduced in [I. Duursma and H.-S. Lee, Lect. Notes Comput. Sci. 2894, 111–123 (2003; Zbl 1189.11056)].

In this paper we present a new pairing, which is closely related to the Eta pairing but which can be used efficiently with ordinary elliptic curves. In addition we show that for the types of curves for which our new pairing applies, one achieves further performance improvements due to the fact that one can represent the group \(G_2\) (additive group)more efficiently than one can normally.

We call our new pairing the Ate pairing, pronounced eight. This is for two reasons, firstly it is like the Tate pairing, but faster (hence the missing ‘T’), it is also like the Eta pairing but it reverses the order of the arguments (and Ate is Eta spelled backwards).

Much of the results in this paper are based on the use of properties of twists of elliptic curves. Many of the results we use are well known to the experts, but we have been unable to locate them in the literature. Hence, we will also present these results related to twists.