Improving the computation of the optimal ate pairing for a high security level

Barreto, Lynn and Scott elliptic curves of embedding degree 12 denoted BLS12 have been proven to present the fastest results on the implementation of pairings for the high security levels (Barbulescu and Duquesne in Updating key size estimations for pairings, 2017. http://eprint.iacr.org/2017/334). In particular, BLS12 curves may presently be preferable for the 128 bits security level compared to the well known BN curves (Duquesne and Ghammam in Groups Complex Cryptol 8(1):75–90, 2016). The computation of pairings in general involves the execution of the Miller algorithm and the final exponentiation. In this paper, we propose new parameters that allow us to reduce the number of operations in the Miller loop and in the final exponentiation for BLS12 and extend the study to BLS24 curves. This improvement is up to $$8\%$$8%, of multiplications in the finite field $$\mathbb {F}_p$$Fp. Furthermore, as pairings can be implemented on memory constrained devices such as SIM or smart cards (Duquesne and Ghammam in Groups Complex Cryptol 8(1):75–90, 2016), we describe in our work an efficient algorithm for the computation of the final exponentiation which is more efficient and less memory intensive with an improvement up to $$25\%$$25% in memory. Our new algorithm can be useful for implementations in a restricted environment.