Low-cost addition–subtraction sequences for the final exponentiation in pairings

In this paper, we address the problem of finding low cost addition–subtraction sequences for situations where a doubling step is significantly cheaper than a non-doubling one. One application of this setting appears in the computation of the final exponentiation step of the reduced Tate pairing defined on ordinary elliptic curves. In particular, we report efficient addition–subtraction sequences for the Kachisa–Schaefer–Scott family of pairing-friendly elliptic curves, whose parameters involve computing the multi-exponentiation of relatively large sequences of exponents with a size of up to 26 bits.