Delaying Mismatched Field Multiplications in Pairing Computations

Miller’s algorithm for computing pairings involves performing multiplications between elements that belong to different finite fields. Namely, elements in the full extension field \(F_{p^k}\) are multiplied by elements contained in proper subfields \(F_{p^{k/d}}\), and by elements in the base field \(F_p\). We show that significant speedups in pairing computations can be achieved by delaying these “mismatched” multiplications for an optimal number of iterations. Importantly, we show that our technique can be easily integrated into traditional pairing algorithms; implementers can exploit the computational savings herein by applying only minor changes to existing pairing code.