Optimal Ate Pairing on Elliptic Curves with Embedding Degree 9, 15 and 27

Since the advent of pairing based cryptography, much attention has been given to efficient computation of pairings on elliptic curves with even embedding degrees. The few works that exist in the case of odd embedding degrees require some improvements. This paper considers the computation of optimal ate pairings on elliptic curves of embedding degrees k = 9, 15 and 27 which have twists of order three. Mainly, we provide a detailed arithmetic and cost estimation of operations in the tower field of the corresponding extension fields. A good selection of parameters at the 128, 192 and 256-bits security level enables us to improve the theoretical cost for the Miller step and the final exponentiation using the lattice-based method comparatively to the previous few works that exist in these cases. In particular for k = 15 we obtain an improvement up to 25% in the computation of the final exponentiation.