lambdaworks
lambdaworks copied to clipboard
lambdaclass
Implement "Efficient Final Exponentiation via Cyclotomic Structure for Pairings over Families of Elliptic Curves"
Follow this paper (page 14) to raise the result of the easy part to the power $3\Phi_{12}(p)/r$. Use a mix of GS cyclotomic squaring and Karabina's cyclotomic square for faster arithmetic in $\mathbb{F}_{p^{12}}$. See here for an implementation of this exact approach in golang (gnark).
The easy part is raising $f$, the outuput of the miller loop, to the power $(1-p^6)(p^2+1)$. For that perform the following steps: $$f \mapsto \bar f \mapsto (\bar f)^{-1} \mapsto (\bar f)^{-1} f \mapsto ((\bar f)^{-1} f)^{p^2}\mapsto ((\bar f)^{-1} f)^{p^2}f$$
Hello! I am trying to build intuition behind calculating the cyclotomic square of an element in Fₚ¹² . So, if f ∈ Fₚ¹²
f = a + bx , where a, b ∈ Fₚ⁶ f = (a₀ + a₁y + a₂y²) + (b₀ + b₁y + b₂y²)x , where a₀,....,b₂ ∈ Fₚ²
Now, f² = [a₀ + a₁y + a₂y²]² + [b₀ + b₁y + b₂y²]²x² + 2x[a₀ + a₁y + a₂y²][b₀ + b₁y + b₂y²]
According to this paper, f² = A₀ + A₁y + A₂y² + (B₀ + B₁y + B₂y²)x² + 2x√A√B
Now consider, Fₚ¹² = Fₚ(t)/t¹² - i , where i is the 12th power residue in Fₚ So, Fₚ² = Fₚ(z)/ z² - i , Fₚ⁶ = Fₚ²(y)/ y³ - √i and Fₚ¹² = Fₚ⁶(x)/ x² - (i)¹/⁶ (i)¹/⁶ = (i)¹/¹²*² = ⍵² , where ⍵ is a 12th root of unity in Fₚ.
Hence, f² = A' + B'⍵² + 2⍵*√A * √B , where A' = A₀ + A₁y + A₂y² , B' = B₀ + B₁y + B₂y² and x² = ⍵²
Does the above make much sense ? I am not sure whether I am arriving at the result correctly. Would love to know your thoughts!
