{"id":21260143,"url":"https://github.com/sdiehl/pairing","last_synced_at":"2025-12-11T23:28:35.414Z","repository":{"id":56874435,"uuid":"158852670","full_name":"sdiehl/pairing","owner":"sdiehl","description":"Optimised bilinear pairings over elliptic curves","archived":false,"fork":false,"pushed_at":"2024-02-03T00:13:39.000Z","size":521,"stargazers_count":56,"open_issues_count":1,"forks_count":7,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-11-02T09:17:35.126Z","etag":null,"topics":["ate-pairing","barreto-naehrig","bilinear-pairing","bls12-381","bls12-curve","bn128","bn254","cryptography","ecc","elliptic-curves","pairing","pairing-cryptography"],"latest_commit_sha":null,"homepage":"","language":"Haskell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sdiehl.png","metadata":{"files":{"readme":"README.md","changelog":"ChangeLog.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-11-23T15:57:12.000Z","updated_at":"2025-04-06T03:42:35.000Z","dependencies_parsed_at":"2024-11-21T04:17:09.267Z","dependency_job_id":"e59e6a2f-71c4-4867-b724-28ba222dfff2","html_url":"https://github.com/sdiehl/pairing","commit_stats":null,"previous_names":["adjoint-io/pairing"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/sdiehl/pairing","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fpairing","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fpairing/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fpairing/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fpairing/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sdiehl","download_url":"https://codeload.github.com/sdiehl/pairing/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fpairing/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27672064,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-11T02:00:11.302Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ate-pairing","barreto-naehrig","bilinear-pairing","bls12-381","bls12-curve","bn128","bn254","cryptography","ecc","elliptic-curves","pairing","pairing-cryptography"],"created_at":"2024-11-21T04:17:05.702Z","updated_at":"2025-12-11T23:28:35.381Z","avatar_url":"https://github.com/sdiehl.png","language":"Haskell","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Hackage](https://img.shields.io/hackage/v/pairing.svg)](https://hackage.haskell.org/package/pairing)\n\nImplementation of the Barreto-Naehrig (BN) curve construction from\n[[BCTV2015]](https://eprint.iacr.org/2013/879.pdf) to provide two cyclic groups\n\u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e, with an efficient bilinear pairing:\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"/tex/b753af639cc1277ae30e8a4e3b25343e.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=129.65328915pt height=13.7899245pt/\u003e\u003c/p\u003e\n\n# Pairing\n\nLet \u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e, \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/e7f497036b4c2ae6d2e022a8a456e8bd.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.31915234999999pt height=22.648391699999998pt/\u003e be abelian groups of prime order \u003cimg src=\"/tex/d5c18a8ca1894fd3a7d25f242cbe8890.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.928106449999989pt height=14.15524440000002pt/\u003e and let \u003cimg src=\"/tex/3cf4fbd05970446973fc3d9fa3fe3c41.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=8.430376349999989pt height=14.15524440000002pt/\u003e and \u003cimg src=\"/tex/2ad9d098b937e46f9f58968551adac57.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.47111549999999pt height=22.831056599999986pt/\u003e elements of \u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e respectively .\nA pairing is a non-degenerate bilinear map \u003cimg src=\"/tex/aa2189a333b8244a7ff28e979414838d.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=129.65328914999998pt height=22.648391699999998pt/\u003e.\n\nThis bilinearity property is what makes pairings such a powerful primitive in cryptography. It satisfies:\n\n* \u003cimg src=\"/tex/979bdabe617751b6bd174b74164006bc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=214.51869779999996pt height=24.65753399999998pt/\u003e\n* \u003cimg src=\"/tex/e85e4bd93fd59c6cc6f6459be9b6d02b.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=217.91855579999995pt height=24.65753399999998pt/\u003e\n\nThe non-degeneracy property guarantees non-trivial pairings for non-trivial arguments. In other words, being non-degenerate means that:\n\n* \u003cimg src=\"/tex/67954e1aad57fcf338705441abb00abe.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=118.51100579999998pt height=22.831056599999986pt/\u003e such that \u003cimg src=\"/tex/b5618eaa407bf223761d20cc793c9a92.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=81.2565633pt height=24.65753399999998pt/\u003e\n* \u003cimg src=\"/tex/23b4158364c14544d3596342fa90ebd1.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=117.92123144999998pt height=22.831056599999986pt/\u003e such that \u003cimg src=\"/tex/00f3d44f5d125d1ac151db5a18ec3176.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=80.66678895pt height=24.65753399999998pt/\u003e\n\nAn example of a pairing would be the scalar product on euclidean space \u003cimg src=\"/tex/8431cd7e7abbe9867faa9394120816af.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=130.22428319999997pt height=24.65753399999998pt/\u003e.\n\n## Example Usage\n\nA simple example of calculating the optimal ate pairing given two points in \u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e.\n\n```haskell\nimport Protolude\n\nimport Data.Group (pow)\nimport Data.Curve.Weierstrass (Point(A), mul')\n\nimport Data.Pairing.BN254 (BN254, G1, G2, pairing)\n\np :: G1 BN254\np = A\n    1368015179489954701390400359078579693043519447331113978918064868415326638035\n    9918110051302171585080402603319702774565515993150576347155970296011118125764\n\n\nq :: G2 BN254\nq = A\n    [2725019753478801796453339367788033689375851816420509565303521482350756874229\n    ,7273165102799931111715871471550377909735733521218303035754523677688038059653\n    ]\n    [2512659008974376214222774206987427162027254181373325676825515531566330959255\n    ,957874124722006818841961785324909313781880061366718538693995380805373202866\n    ]\n\nmain :: IO ()\nmain = do\n  putText \"P:\"\n  print p\n  putText \"Q:\"\n  print q\n  putText \"e(P, Q):\"\n  print (pairing p q)\n  putText \"e(P, Q) is bilinear:\"\n  print (pairing (mul' p a) (mul' q b) == pow (pairing p q) (a * b))\n  where\n    a = 2 :: Int\n    b = 3 :: Int\n```\n\n## Pairings in cryptography\n\nPairings are used in encryption algorithms, such as identity-based encryption (IBE), attribute-based encryption (ABE), (inner-product) predicate encryption, short broadcast encryption and searchable encryption, among others. It allows strong encryption with small signature sizes.\n\n## Admissible Pairings\n\nA pairing \u003cimg src=\"/tex/8cd34385ed61aca950a6b06d09fb50ac.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.654137149999991pt height=14.15524440000002pt/\u003e is called admissible pairing if it is efficiently computable. The only admissible pairings that are suitable for cryptography are the Weil and Tate pairings on algebraic curves and their variants. Let \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e be the order of a group and \u003cimg src=\"/tex/16550160480e99b79b926819fb336057.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=30.087580049999985pt height=24.65753399999998pt/\u003e be the entire group of points of order \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e on \u003cimg src=\"/tex/9065752c9bc4848759fa7b3ec2b823e6.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=43.17302714999999pt height=24.65753399999998pt/\u003e. \u003cimg src=\"/tex/16550160480e99b79b926819fb336057.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=30.087580049999985pt height=24.65753399999998pt/\u003e is called the r-torsion and is defined as \u003cimg src=\"/tex/f1fa149eaf21295923f0a8b4c9abed5e.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=204.73357245pt height=24.65753399999998pt/\u003e. Both Weil and Tate pairings require that \u003cimg src=\"/tex/df5a289587a2f0247a5b97c1e8ac58ca.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.83677559999999pt height=22.465723500000017pt/\u003e and \u003cimg src=\"/tex/1afcdb0f704394b16fe85fb40c45ca7a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.99542474999999pt height=22.465723500000017pt/\u003e come from disjoint cyclic subgroups of the same prime order \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e. Lagrange's theorem states that for any finite group \u003cimg src=\"/tex/a158a43ace9779e0a6109b3c9f9df93d.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.785434199999989pt height=22.648391699999998pt/\u003e, the order (number of elements) of every subgroup \u003cimg src=\"/tex/0bc31dc06fb3dadf20c94db3afdb694a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.785434199999989pt height=22.648391699999998pt/\u003e of \u003cimg src=\"/tex/a158a43ace9779e0a6109b3c9f9df93d.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.785434199999989pt height=22.648391699999998pt/\u003e divides the order of \u003cimg src=\"/tex/a158a43ace9779e0a6109b3c9f9df93d.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.785434199999989pt height=22.648391699999998pt/\u003e. Therefore, \u003cimg src=\"/tex/0f3f091e62e5f23978d35d57e9ffa0d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=69.31087844999999pt height=24.65753399999998pt/\u003e.\n\n\u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e are subgroups of a group defined in an elliptic curve over an extension of a finite field \u003cimg src=\"/tex/caff3f0c7c8d34853f77a22381f40cf2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=16.48352474999999pt height=22.648391699999998pt/\u003e, namely \u003cimg src=\"/tex/93dbbc26f21ac41f18471eb4398429bb.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=50.35916489999999pt height=24.65753399999998pt/\u003e, where \u003cimg src=\"/tex/d5c18a8ca1894fd3a7d25f242cbe8890.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.928106449999989pt height=14.15524440000002pt/\u003e is the characteristic of the field and \u003cimg src=\"/tex/63bb9849783d01d91403bc9a5fea12a2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.075367949999992pt height=22.831056599999986pt/\u003e is a positive integer called embedding degree.\n\nThe embedding degree \u003cimg src=\"/tex/63bb9849783d01d91403bc9a5fea12a2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.075367949999992pt height=22.831056599999986pt/\u003e plays a crucial role in pairing cryptography:\n\n- It's the value that makes \u003cimg src=\"/tex/80b2c95f69ac5dd580383297069098dc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e be the smallest extension of \u003cimg src=\"/tex/caff3f0c7c8d34853f77a22381f40cf2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=16.48352474999999pt height=22.648391699999998pt/\u003e such that \u003cimg src=\"/tex/93dbbc26f21ac41f18471eb4398429bb.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=50.35916489999999pt height=24.65753399999998pt/\u003e captures more points of order \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e.\n- It's the minimal value that holds \u003cimg src=\"/tex/5303376aa33129a68bbd6097d8dd83cf.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=69.55104419999999pt height=27.91243950000002pt/\u003e.\n- It's the smallest positive integer such that \u003cimg src=\"/tex/db1792343c4e68f6025271b59ac7929a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=102.36437639999998pt height=24.65753399999998pt/\u003e.\n\nThere are subtle but relevant differences in \u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e subgroups depending on the type of pairing. Nowadays, all of the state-of-the-art implementations of pairings take place on ordinary curves and assume a type of pairing (Type 3) where  \u003cimg src=\"/tex/07556c07e775ab96ece5eeca39d1cc6e.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=177.14789729999998pt height=24.65753399999998pt/\u003e and  \u003cimg src=\"/tex/1257a6bc550c7d68505b01b9e2b12973.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=176.8567746pt height=24.65753399999998pt/\u003e and there is no non-trivial map \u003cimg src=\"/tex/b7707db8fc92965efd729ad2cf48ef19.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=90.63907379999998pt height=22.648391699999998pt/\u003e.\n\n## Tate Pairing\n\nThe Tate pairing is a map:\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"/tex/934aebfe0542c0b82cd08ffe1c7e4cc9.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=332.81155214999995pt height=19.40433495pt/\u003e\u003c/p\u003e\n\ndefined as:\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"/tex/325959111b8ba6bc4eeca7eebcb4f069.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=114.44397855pt height=16.438356pt/\u003e\u003c/p\u003e\n\nwhere \u003cimg src=\"/tex/d72d3ec62eb390272bc7b3516a1cac9a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=100.29247799999997pt height=24.65753399999998pt/\u003e, \u003cimg src=\"/tex/1afcdb0f704394b16fe85fb40c45ca7a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.99542474999999pt height=22.465723500000017pt/\u003e is any representative in a equivalence\nclass in \u003cimg src=\"/tex/a8fa96013baa8aef490c7dd5e656f95c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=116.81049434999998pt height=24.65753399999998pt/\u003e and \u003cimg src=\"/tex/82fe41333ac19f47e8ab380aef250c84.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=76.44519959999998pt height=24.65753399999998pt/\u003e is the set of\nequivalence classes of \u003cimg src=\"/tex/8a239a22eaa3b75f31f7ca91114761bf.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e under the\nequivalence relation \u003cimg src=\"/tex/0cd4c14307108486c8467c666f1795b9.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=173.85185565pt height=24.65753399999998pt/\u003e. The equivalence\nrelation in the output of the Tate pairing is unfortunate. In cryptography,\ndifferent parties must compute the same value under the bilinearity property.\n\nThe reduced Tate pairing solves this undesirable property by exponentiating elements in \u003cimg src=\"/tex/82fe41333ac19f47e8ab380aef250c84.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=76.44519959999998pt height=24.65753399999998pt/\u003e to the power of \u003cimg src=\"/tex/0582678783a97ba6dff05ad4614486ae.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=73.20403034999998pt height=27.91243950000002pt/\u003e. It maps all elements in an equivalence class to the same value. It is defined as:\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"/tex/f35a3ddecd1dce2f2f71cf7dd515052f.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=326.17488749999995pt height=22.158967049999998pt/\u003e\u003c/p\u003e\n\nWhen we say Tate pairing, we will mean the reduced Tate pairing.\n\n## Pairing optimization\n\nTate pairings use Miller's algorithm, which is essentially the double-and-add algorithm for elliptic curve point multiplication combined with evaluation of the functions used in the addition process. Miller's algorithm remains the fastest algorithm for computing pairings to date.\n\nBoth \u003cimg src=\"/tex/8409cecadf19745123272729a965e4d7.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/baaccbfbf8339cdf5809bac3564ee664.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=19.33798019999999pt height=22.648391699999998pt/\u003e are elliptic curve groups. \u003cimg src=\"/tex/e7f497036b4c2ae6d2e022a8a456e8bd.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.31915234999999pt height=22.648391699999998pt/\u003e\nis a multiplicative subgroup of a finite field. The security an elliptic curve\ngroup offers per bit is considerably greater than the security a finite field\ndoes. In order to achieve security comparable to 128-bit security (AES-128), an\nelliptic curve of 256 bits will suffice, while we need a finite field of 3248\nbits. The aim of a cryptographic protocol is to achieve the highest security\ndegree with the smallest signature size, which normally leads to a more\nefficient computation. In pairing cryptography, significant improvements can be\nmade by keeping all three group sizes the same. It is possible to find elliptic\ncurves over a field \u003cimg src=\"/tex/caff3f0c7c8d34853f77a22381f40cf2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=16.48352474999999pt height=22.648391699999998pt/\u003e whose largest prime order subgroup \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e has the\nsame bit-size as the characteristic of the field \u003cimg src=\"/tex/d5c18a8ca1894fd3a7d25f242cbe8890.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.928106449999989pt height=14.15524440000002pt/\u003e. The ratio between the\nfield size \u003cimg src=\"/tex/d5c18a8ca1894fd3a7d25f242cbe8890.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.928106449999989pt height=14.15524440000002pt/\u003e and the large prime group order \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e is called the \u003cimg src=\"/tex/417a5301693b60807fa658e5ef9f9535.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=10.75343279999999pt height=14.15524440000002pt/\u003e-value. It is an important value that indicates how much (ECDLP) security a\ncurve offers for its field size. \u003cimg src=\"/tex/7389b1fbd05eef717998c1aab5b4a1aa.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=40.890273599999986pt height=21.18721440000001pt/\u003e is the optimal value. The Barreto-Naehrig\n(BN) family of curves all have \u003cimg src=\"/tex/7389b1fbd05eef717998c1aab5b4a1aa.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=40.890273599999986pt height=21.18721440000001pt/\u003e and \u003cimg src=\"/tex/4e4e9e48c57d8466e7e08e7c4ebe508d.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=47.43141149999999pt height=22.831056599999986pt/\u003e. They are perfectly suited to the\n128-bit security level.\n\nMost operations in pairings happen in the extension field \u003cimg src=\"/tex/80b2c95f69ac5dd580383297069098dc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e. The larger \u003cimg src=\"/tex/63bb9849783d01d91403bc9a5fea12a2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.075367949999992pt height=22.831056599999986pt/\u003e gets, the more complex \u003cimg src=\"/tex/80b2c95f69ac5dd580383297069098dc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e becomes and the more computationally expensive the pairing becomes. The complexity of Miller's algorithm heavily depends on the complexity of the associated \u003cimg src=\"/tex/80b2c95f69ac5dd580383297069098dc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e-arithmetic. Therefore, the aim is to minimize the cost of arithmetic in \u003cimg src=\"/tex/80b2c95f69ac5dd580383297069098dc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e.\n\nIt is possible to construct an extension of a field \u003cimg src=\"/tex/80b2c95f69ac5dd580383297069098dc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84774634999999pt height=22.648391699999998pt/\u003e by successively towering up intermediate fields \u003cimg src=\"/tex/732ed93a5ff71133677429d72cb7556b.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.84869509999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/b01bf40549686b772ea80e93f43fa41a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=21.689032199999993pt height=22.648391699999998pt/\u003e such that \u003cimg src=\"/tex/180a0168ede334d7194e131ce713db21.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=58.314248849999984pt height=27.15900329999998pt/\u003e, where \u003cimg src=\"/tex/44bc9d542a92714cac84e01cbbb7fd61.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=8.68915409999999pt height=14.15524440000002pt/\u003e and \u003cimg src=\"/tex/4bdc8d9bcfb35e1c9bfb51fc69687dfc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.054796099999991pt height=22.831056599999986pt/\u003e are usually 2 and 3. One of the reasons tower extensions work is that quadratic and cubic extensions (\u003cimg src=\"/tex/cc7ec45cd96d0abf539613b130791bf0.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.07722274999999pt height=22.648391699999998pt/\u003e and \u003cimg src=\"/tex/ec2f196eb05ace7dafb92181f3299ab2.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=22.07722274999999pt height=22.648391699999998pt/\u003e) offer methods of performing arithmetic more efficiently.\n\nMiller's algorithm in the Tate pairing iterates as far as the prime group order \u003cimg src=\"/tex/89f2e0d2d24bcf44db73aab8fc03252c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.87295519999999pt height=14.15524440000002pt/\u003e, which is a large number in cryptography. The ate pairing comes up as an optimization of the Tate pairing by shortening Miller's loop. It achieves a much shorter loop of length \u003cimg src=\"/tex/57eb5a87bd0a02676d91a2ef9eab143d.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=68.05343984999999pt height=22.465723500000017pt/\u003e on an ordinary curve, where t is the trace of the Frobenius endomorphism. The ate pairing is defined as:\n\n\u003cp align=\"center\"\u003e\u003cimg src=\"/tex/fd4f50056fd1a09fd9fe4a27d0b0a084.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=190.8686406pt height=22.158967049999998pt/\u003e\u003c/p\u003e\n\n## Implementation\n\nWe have implemented a polymorphic optimal ate pairing over the following pairing-friendly elliptic curves:\n\n* Barreto-Lynn-Scott degree 12 curves\n  * [BLS12381](src/Data/Pairing/BLS12381.hs)\n* Barreto-Naehrig curves\n  * [BN254](src/Data/Pairing/BN254.hs)\n  * [BN254A](src/Data/Pairing/BN254A.hs)\n  * [BN254B](src/Data/Pairing/BN254B.hs)\n  * [BN254C](src/Data/Pairing/BN254C.hs)\n  * [BN254D](src/Data/Pairing/BN254D.hs)\n  * [BN462](src/Data/Pairing/BN462.hs)\n\nA more detailed documentation on their domain parameters can be found in our [elliptic curve library](https://github.com/adjoint-io/elliptic-curve).\n\n## Disclaimer\n\nThis is experimental code meant for research-grade projects only. Please do not\nuse this code in production until it has matured significantly.\n\n## License\n\n```\nCopyright (c) 2018-2024 Stephen Diehl.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\nIN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,\nDAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\nOTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE\nOR OTHER DEALINGS IN THE SOFTWARE.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsdiehl%2Fpairing","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsdiehl%2Fpairing","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsdiehl%2Fpairing/lists"}