During more than 15 years as a Principal Researcher at Microsoft Research, Peter L. Montgomery contributed substantially to building the public key cryptography libraries for Microsoft. The field of Elliptic Curve Cryptography (ECC) was scarcely 15 years old, and pairing-based cryptography had been recently introduced, when Peter started working on implementing and optimizing cryptographic pairings on elliptic and hyperelliptic curves.

By pairings on elliptic curves in the cryptographic setting, we are referring to bilinear maps from the group of points on an elliptic curve to the multiplicative group of a finite field, most notably the Weil pairing. Cryptographic pairings became a hot topic after the introduction of solutions for various interesting cryptographic primitives, including identity-based non-interactive key agreement [297], one-round tripartite Diffie–Hellman key exchange [194, 195], identity-based encryption [58] and short signatures [60, 61]. A flood of other cryptographic applications and constructions followed, such as attributebased encryption [296], functional encryption [62], and homomorphic encryption [59], to name a few. Pairings originally played a key role in the earlier Menezes-Okamoto-Vanstone [243] and Frey-Rück [151] attacks on supersingular elliptic curves, which had instead negative implications for cryptographic primitives using such curves. All cryptographic applications of pairings rely on the ability to find suitable elliptic curve parameters and the existence of efficient algorithms to compute in the groups involved in the pairing operation and for the pairing computation itself.

This chapter is based on the three papers, [137], [138] and [227] on pairing computation, which Peter coauthored with one or both of the authors. The text contains excerpts from those works, lightly edited with adjustments made to unify notation and embed into the context of this chapter.

One of Peter's guiding principleswas to always write and prove everything in the most general possible case, which led him, for example, to insist on giving formulas for the often pesky case of characteristic two. The code he wrote was usually intended to be most general in the sense that it should allow to be compiled and run efficiently and securely on a wide variety of possible processors.