Implementing Pairings at the 192-Bit Security Level
The authors implement asymmetric pairings derived from Kachisa-Schaefer-Scott (KSS), Barreto-Naehrig (BN), and Barreto-Lynn-Scott (BLS) elliptic curves at the 192-bit security level. Somewhat surprisingly, they find pairings derived from BLS curves with embedding degree 12 to be the fastest for their serial as well as their parallel implementations. The serial implementations provide a factor-3 speedup over the previous state-of-the-art, demonstrating that pairing computation at the 192-bit security level is not as expensive as previously thought. They also present a general framework for deriving a Weil-type pairing that is well-suited for computing a single pairing on a multi-processor machine.