Craig Costello

World-Leaders in Cryptography · 2026

World-Leaders in Cryptography

Apple Spotify Audible

Microsoft Research Podcast · 2019

News from the front in the post-quantum crypto wars

AISA · Cyber Voices · 2026

Quantum Safe Queensland: a Practical Roadmap

Apple Amazon

All podcasts, interviews and videos (11)

Watch

Public Sector Network · 2026

Preparing for the Post-Quantum Deadline: Why Governments Need to Upgrade Encryption Now

Watch

AIPIO Round Table · 2026

Quantum Computing Meets AI Implications for the Future of Intelligence Practice

AISA · Cyber Voices · 2026

Quantum Safe Queensland: a Practical Roadmap

Apple Amazon

3RRR · Byte into IT · 2026

Radio Interview on Post-Quantum Cryptography

World-Leaders in Cryptography · 2026

World-Leaders in Cryptography

Apple Spotify Audible

ABC Radio Brisbane · 2025

Radio Interview with Ellen Fanning

FiveAA Radio · 2025

Scam awareness week

ABC Radio Brisbane · 2025

Radio Interview with ABC Brisbane

Watch

Microsoft Research Webinar · 2020

Post-quantum cryptography: Supersingular isogenies for beginners

Microsoft Research Podcast · 2019

News from the front in the post-quantum crypto wars

Watch on TED

TEDxSydney · TED · 2019

In the war for information, will quantum computers defeat cryptographers?

2.3M+ plays on TED

In print

All written media

Cryptographers aim to future-proof protocol

The Australian · 2015

The quantum threat to your data and our race to stop it

QUT · Real Focus · 2025

Quantum computers threaten to break online security in minutes

Cosmos Magazine · 2025

Microsoft throws crypto foes an untouchable elliptic curveball

The Register · 2015

Securing Today’s Data Against Tomorrow’s Quantum Computers

MIT Technology Review · 2015

All written media (18)

IT leaders warn AI could erode vital technical skills

IT Brief Australia · 2026

153 million driver licenses exposed on dark web

ACS Information Age · 2026

Women’s Cyber Underrepresentation Deepens as AI Grows

Security Brief Australia · 2026

Origin Energy probes alleged cyber incident over data.

Security Brief Australia · 2026

NSW nurse charged over alleged data breach

ACS Information Age · 2026

What the Origin Energy hack means for Australian consumers and businesses

Cyber Daily · 2026

Origin Energy Investigating Possible Data Breach

ACS Information Age · 2026

Quantum computers are coming to break our codes faster than anyone expected

The Conversation · 2026

The quantum threat to your data and our race to stop it

QUT · Real Focus · 2025

The industry speaks: Scam Awareness Week 2025

Cyber Daily · 2025

AI Isn’t Coming For Jobs

Education Today · 2025

Qantas breach sparks national push for stronger cyber resilience

Security Brief Australia · 2025

Future workforce needs curious minds

Education Matters Magazine · 2025

Quantum computers threaten to break online security in minutes

Cosmos Magazine · 2025

IT Workers Will Thrive in the AI Era

Education Today · 2025

Microsoft throws crypto foes an untouchable elliptic curveball

The Register · 2015

Cryptographers aim to future-proof protocol

The Australian · 2015

Securing Today’s Data Against Tomorrow’s Quantum Computers

MIT Technology Review · 2015

Research Publications

All papers

2026

Cycles of supersingular elliptic curves for pairing-based proof systems

Craig Costello and Gaurish Korpal. IACR Communications in Cryptology, Vol 2, Issue 4, 2026

2026

Efficient algorithms for the detection of (N,N)-splittings and endomorphisms

Maria Corte-Real Santos, Craig Costello, and Sam Frengley. Journal of Cryptology, vol. 39(2), 2026

Full version

2025

On pairs of primes with small order reciprocity

Craig Costello and Gaurish Korpal. LuCaNT 2025, Contemporary Mathematics, American Mathematical Society, to appear

2025

Efficient (3,3)-isogenies on fast Kummer surfaces

Maria Corte-Real Santos, Craig Costello, and Benjamin Smith. ANTS XVI; Research in Number Theory, vol. 11, 2025

Full version

All papers (42)

Cycles of supersingular elliptic curves for pairing-based proof systems

Craig Costello and Gaurish Korpal. IACR Communications in Cryptology, Vol 2, Issue 4, 2026

Efficient algorithms for the detection of (N,N)-splittings and endomorphisms

Maria Corte-Real Santos, Craig Costello, and Sam Frengley. Journal of Cryptology, vol. 39(2), 2026

On pairs of primes with small order reciprocity

Craig Costello and Gaurish Korpal. LuCaNT 2025, Contemporary Mathematics, American Mathematical Society, to appear

Efficient (3,3)-isogenies on fast Kummer surfaces

Maria Corte-Real Santos, Craig Costello, and Benjamin Smith. ANTS XVI; Research in Number Theory, vol. 11, 2025

On cycles of pairing-friendly abelian varieties

Maria Corte-Real Santos, Craig Costello, and Michael Naehrig. CRYPTO 2024

An algorithm for efficient detection of (N, N)-splittings and its application to the isogeny problem in dimension 2

Maria Corte-Real Santos, Craig Costello, and Sam Frengley. PKC2024. Best Paper Award

Cryptographic Smooth Neighbors

Giacomo Bruno, Maria Corte-Real Santos, Craig Costello, Jonathan Komada Eriksen, Michael Meyer, Michael Naehrig, and Bruno Sterner. ASIACRYPT 2023

Accelerating the Delfs-Galbraith algorithm with fast subfield root detection

Maria Corte-Real Santos, Craig Costello and Jia Shi. CRYPTO 2022

The Case for SIKE: A Decade of the Supersingular Isogeny Problem

Craig Costello. The NIST 3rd Post-Quantum Cryptography Standardization Conference. White paper

Sieving for twin smooth integers with solutions to the Prouhet-Tarry-Escott problem

Craig Costello, Michael Meyer and Michael Naehrig. EUROCRYPT 2021

B-SIDH: supersingular isogeny Diffie-Hellman using twisted torsion

Craig Costello. ASIACRYPT 2020

The supersingular isogeny problem in genus 2 and beyond

Craig Costello and Benjamin Smith. PQCrypto 2020

Improved classical cryptanalysis of SIKE in practice

Craig Costello, Patrick Longa, Michael Naehrig, Joost Renes and Fernando Virdia. PKC 2020

Supersingular isogeny key exchange for beginners

Craig Costello. Invited paper at SAC 2019

Computing supersingular isogenies on Kummer surfaces

Craig Costello. ASIACRYPT 2018

A simple and compact algorithm for SIDH with arbitrary degree isogenies

Craig Costello and Huseyin Hisil. ASIACRYPT 2017

Montgomery curves and their arithmetic: the case of large characteristic fields

Craig Costello and Benjamin Smith. Special issue of Journal of Cryptographic Engineering in tribute to Peter L. Montgomery, 2017

Efficient compression of SIDH public keys

Craig Costello, David Jao, Patrick Longa, Michael Naehrig, Joost Renes and David Urbanik. EUROCRYPT 2017

Frodo: Take off the ring! Practical, Quantum-Secure Key Exchange from LWE

Joppe Bos, Craig Costello, Léo Ducas, Ilya Mironov, Michael Naehrig, Valeria Nikolaenko, Ananth Raghunathan and Douglas Stebila. ACM CCS 2016

Efficient algorithms for supersingular isogeny Diffie-Hellman

Craig Costello, Patrick Longa and Michael Naehrig. CRYPTO 2016

Complete addition formulas for prime order elliptic curves

Joost Renes, Craig Costello and Lejla Batina. EUROCRYPT 2016

Fast, Uniform Scalar Multiplication for Genus 2 Jacobians with Fast Kummers

Ping Ngai Chung, Craig Costello and Benjamin Smith. SAC 2016

FourQ: four-dimensional decompositions on a Q-curve over the Mersenne prime

Craig Costello and Patrick Longa. ASIACRYPT 2015

Subgroup security in pairing-based cryptography

Paulo S. L. M. Barreto, Craig Costello, Rafael Misoczki, Michael Naehrig, Geovandro C. C. F. Pereira and Gustavo Zanon. LATINCRYPT 2015

Gepetto: Versatile Verifiable Computation

Craig Costello, Cedric Fournet, Jon Howell, Markulf Kohlweiss, Benjamin Kreuter, Michael Naehrig, Bryan Parno, and Samee Zahur. IEEE S&P2015

Post-quantum key exchange for the TLS protocol from the ring learning with errors problem

Joppe W. Bos, Craig Costello, Michael Naehrig, and Douglas Stebila. IEEE S&P2015

Selecting Elliptic Curves for Cryptography: An Efficiency and Security Analysis

Joppe W. Bos, Craig Costello, Patrick Longa, and Michael Naehrig. Journal of Cryptographic Engineering, 2015

Jacobian Coordinates on Genus 2 Curves

Huseyin Hisil and Craig Costello. ASIACRYPT 2014 and Journal of Cryptology

Constructing Abelian Surfaces for Cryptography via Rosenhain Invariants

Craig Costello, Alyson Deines-Schartz, Kristin Lauter, and Tonghai Yang. ANTS 2014

Faster Compact Diffie-Hellman: Endomorphisms on the x-line

Craig Costello, Huseyin Hisil, and Benjamin Smith. EUROCRYPT 2014

Elliptic and Hyperelliptic Curves: a Practical Security Analysis

Joppe W. Bos, Craig Costello, and Andrea Miele. PKC 2014

Exponentiating in Pairing Groups

Joppe W. Bos, Craig Costello, and Michael Naehrig. SAC 2013

High-Performance Scalar Multiplication using 8-Dimensional GLV/GLS Decomposition

Joppe W. Bos, Craig Costello, Huseyin Hisil and Kristin Lauter. CHES 2013

Fast Cryptography in Genus 2

Joppe W. Bos, Craig Costello, Huseyin Hisil and Kristin Lauter. EUROCRYPT 2013 and the Journal of Cryptology

Fast formulas for computing cryptographic pairings

Craig Costello. Ph.D. thesis

Attractive subfamilies of BLS Curves for Implementing High-Security Pairings

Craig Costello, Kristin Lauter, and Michael Naehrig. INDOCRYPT 2011

Group Law Computations on Jacobians of Hyperelliptic Curves

Craig Costello and Kristin Lauter. SAC 2011

Fixed Argument Pairings

Craig Costello and Douglas Stebila. LATINCRYPT 2010

Delaying mismatched field multiplications in pairing computations

Craig Costello, Colin Boyd, Juan Manuel Gonzalez Nieto, and Kenneth Koon-Ho Wong. WAIFI 2010

Avoiding full extension field arithmetic in pairing computations

Craig Costello, Colin Boyd, Juanma Gonzalez-Nieto, and Kenneth Koon-Ho Wong. AFRICACRYPT 2010

Faster pairing computations on curves with high-degree twists

Craig Costello, Tanja Lange, and Michael Naehrig. PKC 2010

Faster pairings on special Weierstrass curves

Craig Costello, Huseyin Hisil, Colin Boyd, Juan Manuel Gonzalez Nieto, and Kenneth Koon-Ho Wong. PAIRING 2009

Research Talks

All research talks

Opening slide: The promise of isogeny-based cryptography

Workshop on Elliptic Curves, Sydney. October 2, 2026

The promise of isogeny-based cryptography

Opening slide: An introduction to hyperelliptic curve cryptography

Workshop on Elliptic Curves, Sydney. October 1, 2026

An introduction to hyperelliptic curve cryptography

Opening slide: An introduction to elliptic curve cryptography

Workshop on Elliptic Curves, Sydney, October 1, 2026

An introduction to elliptic curve cryptography

Opening slide: The Future of Encryption: Higher Education and Preparing for the Post-Quantum Shift

AHECS Cybersecurity Summit, September 15, 2026

The Future of Encryption: Higher Education and Preparing for the Post-Quantum Shift

All research talks (72)

Workshop on Elliptic Curves, Sydney. October 2, 2026

The promise of isogeny-based cryptography

Workshop on Elliptic Curves, Sydney. October 1, 2026

An introduction to hyperelliptic curve cryptography

Workshop on Elliptic Curves, Sydney, October 1, 2026

An introduction to elliptic curve cryptography

AHECS Cybersecurity Summit, September 15, 2026

The Future of Encryption: Higher Education and Preparing for the Post-Quantum Shift

Opening slide: The Future of Encryption: Preparing Governement for the Post-Quantum Shift

QLD Government Cybersecurity Showcase, September 10, 2026

The Future of Encryption: Preparing Governement for the Post-Quantum Shift

Opening slide: Quantum-Safe Queensland: A practical post-quantum cryptography roadmap to 2030 and beyond

BrisSec, April 29, 2026

Quantum-Safe Queensland: A practical post-quantum cryptography roadmap to 2030 and beyond

Opening slide: Safeguarding the future with post-quantum cryptography

Keynote at ACS Tech Summit, Brisbane, May 2025

Safeguarding the future with post-quantum cryptography

Opening slide: On cycles of pairing-friendly abelian varieties

CRYPTO 2024. August 2024

On cycles of pairing-friendly abelian varieties

Opening slide: Finding twin smooth integers

RMIT Cybersecurity Seminar. March 29, 2023

Finding twin smooth integers

Opening slide: Post-quantum key exchange from supersingular isogenies

IPAM Summer School on Post-Quantum Cryptography, UCLA. July 26, 2022

Post-quantum key exchange from supersingular isogenies

Opening slide: The Case for SIKE: A Decade of the Supersingular Isogeny Problem

2nd International Conference on Security and Privacy, November 17, 2021

The Case for SIKE: A Decade of the Supersingular Isogeny Problem

Isogeny-based cryptography school, September 9, 2021

Why Hyperelliptic?

Opening slide: Finding twin smooth integers for isogeny-based cryptography

University College London InfoSec Seminar, Feb 11, 2021

Finding twin smooth integers for isogeny-based cryptography

NIST 3rd PQC Standardization Conference, June 2021

The Case for SIKE: A Decade of the Supersingular Isogeny Problem

Opening slide: B-SIDH: supersingular isogeny Diffie-Hellman using twisted torsion

ASIACRYPT 2020, Dec 2020

B-SIDH: supersingular isogeny Diffie-Hellman using twisted torsion

Opening slide: The supersingular isogeny problem in genus 2 and beyond

PQCrypto2020, September 2020

The supersingular isogeny problem in genus 2 and beyond

Opening slide: Post-quantum cryptography: supersingular isogenies for beginners

Microsoft Research Webinar, May 2020

Post-quantum cryptography: supersingular isogenies for beginners

Opening slide: The state of the art in supersingular isogenies: the SIKE protocol and its cryptanalysis

Invited talk at Selected Areas of Cryptography (SAC), Waterloo, Canada – August 16, 2019

The state of the art in supersingular isogenies: the SIKE protocol and its cryptanalysis

Opening slide: Isogeny-based cryptography: a gentle introduction to post-quantum ECC

Tutorial at SAC Summer School, Waterloo, Canada – August 12, 2019

Isogeny-based cryptography: a gentle introduction to post-quantum ECC

Opening slide: A gentle introduction to elliptic curve cryptography

Tutorial at SAC Summer School, Waterloo, Canada – August 12, 2019

A gentle introduction to elliptic curve cryptography

Talk at Oxford Post-Quantum Cryptography Workshop – March 20, 2019

SIKE Round 2

Opening slide: Classical cryptanalysis of supersingular isogenies

Talk at ASEC 2018, Adelaide, Australia – Dec 10, 2018

Classical cryptanalysis of supersingular isogenies

Opening slide: Computing supersingular isogenies on Kummer surfaces

Talk at ASIACRYPT 2018, Brisbane, Australia – Dec 6, 2018

Computing supersingular isogenies on Kummer surfaces

Opening slide: Supersingular isogenies in cryptography

Talk at Summer School on Real World Crypto and Privacy, Šibenik, Croatia – June 15, 2018

Supersingular isogenies in cryptography

Tutorial at Summer School on Real World Crypto and Privacy, Šibenik, Croatia – June 11, 2018

A gentle introduction to elliptic curve cryptography

Opening slide: A simple and compact algorithm for SIDH with arbitrary degree isogenies

Talk at ASIACRYPT 2017, Hong Kong, China- Dec 5, 2017

A simple and compact algorithm for SIDH with arbitrary degree isogenies

Opening slide: Supersingular Isogeny Key Encapsulation

Invited talk at ECC2017, Nijmegen, Netherlands – Nov 14, 2017

Supersingular Isogeny Key Encapsulation

Opening slide: An introduction to supersingular isogeny-based cryptography

Talk at ECC2017, Nijmegen, Netherlands – Nov 10, 2017

An introduction to supersingular isogeny-based cryptography

Talk at Summer School on Real World Crypto and Privacy, Šibenik, Croatia – June 8, 2017

An introduction to supersingular isogeny-based cryptography

Tutorial at Summer School on Real World Crypto and Privacy, Šibenik, Croatia – June 5, 2017

A gentle introduction to elliptic curve cryptography

Opening slide: Post-quantum key exchange for the Internet based on lattices

Seminar at MSR India, Bangalore, India – Dec 21, 2016

Post-quantum key exchange for the Internet based on lattices

Opening slide: Practical post-quantum key exchange from supersingular isogenies

Invited talk at SPACE2016, University of Hyderabad, Hyderabad, India – Dec 18, 2016

Practical post-quantum key exchange from supersingular isogenies

Opening slide: A gentle introduction to isogeny-based cryptography

Tutorial talk at SPACE2016, University of Hyderabad, Hyderabad, India – Dec 15, 2016

A gentle introduction to isogeny-based cryptography

Tutorial talk at SPACE2016, University of Hyderabad, Hyderabad, India – Dec 15, 2016

A gentle introduction to elliptic curve cryptography

Algebra seminar at University of Auckland, Auckland, New Zealand – Nov 16, 2016

Post-quantum key exchange for the Internet based on lattices.

Recording

Opening slide: Efficient algorithms for supersingular isogeny Diffie-Hellman

Talk at CRYPTO2016, Santa Barbara, USA – Aug 17, 2016

Efficient algorithms for supersingular isogeny Diffie-Hellman

Talk at Radboud University, Nijmegen, Netherlands – May 4, 2016

Efficient algorithms for supersingular isogeny Diffie-Hellman

Opening slide: Post-quantum key exchange from ideal lattices

Talk at QUT Maths Seminars series, Brisbane, Australia – Apr 1, 2016

Post-quantum key exchange from ideal lattices

Talk at QUT Maths Seminars series, Brisbane, Australia – Mar 18, 2016

An introduction to elliptic curve cryptography

Opening slide: FourQ: four-dimensional decompositions on a Q-curve over the Mersenne prime

Talk at AsiaCrypt2015, Auckland, New Zealand- Nov 30, 2015

FourQ: four-dimensional decompositions on a Q-curve over the Mersenne prime

Opening slide: FourQ: four-dimensional decompositions on a Q-curve

Talk at NIST Workshop on Elliptic Curve Cryptography Standards, Gaithersburg, Maryland, USA – June 12, 2015

FourQ: four-dimensional decompositions on a Q-curve

Opening slide: A brief discussion on selecting new elliptic curves

Talk at NIST Workshop on Elliptic Curve Cryptography Standards, Gaithersburg, Maryland, USA – June 11, 2015

A brief discussion on selecting new elliptic curves

Opening slide: Genus 2 curves in cryptography: successes and challenges

Talk at AMS Special Session on Arithmetic Geometry, University of Nevada, Las Vegas, USA – April 20, 2015

Genus 2 curves in cryptography: successes and challenges

Opening slide: Post-quantum key exchange from the ring learning with errors problem

NIST Workshop on Cybersecurity in a Post-Quantum World, Gaithersburg, Maryland, USA – April 3, 2015

Post-quantum key exchange from the ring learning with errors problem

MSR Annual Privacy Workshop, Redmond, USA – October 29, 2014

Post-quantum key exchange from the ring learning with errors problem

Opening slide: Selecting Elliptic Curves for Cryptography: an Efficiency and Security Analysis

Invited talk at ECC2014, Ramanujan Auditorium, Chennai, India – October 9, 2014

Selecting Elliptic Curves for Cryptography: an Efficiency and Security Analysis

Opening slide: A quick quiz on cricket and crypto

Rump session talk at ECC2014, Ramanujan Auditorium, Chennai, India – October 8, 2014

A quick quiz on cricket and crypto

Opening slide: Deterministic Generation of Elliptic Curves (a.k.a. “NUMS” Curves)

Talk at ITEF-90, Toronto, Canada – July 23, 2014

Deterministic Generation of Elliptic Curves (a.k.a. “NUMS” Curves)

Opening slide: Faster Compact Diffie-Hellman: Endomorphisms on the x-line

EuroCrypt2014, Scandic Hotel, Copenhagen, Denmark – May 12, 2014

Faster Compact Diffie-Hellman: Endomorphisms on the x-line

MSR Annual Privacy Workshop, Redmond, USA – October 25, 2013

Faster Compact Diffie-Hellman: Endomorphisms on the x-line

Opening slide: The State-of-the-Art in Hyperelliptic Curve Cryptography

Workshop on Curves and Applications, Calgary, Canada – August 19, 2013

The State-of-the-Art in Hyperelliptic Curve Cryptography

Opening slide: Exponentiating in Pairing Groups

SAC2013, Simon Fraser University, Vancouver, Canada – August 16, 2013

Exponentiating in Pairing Groups

Opening slide: Faster compact Diffie-Hellman

Lunchtime talk at Microsoft Research, Redmond, USA – June 19, 2013

Faster compact Diffie-Hellman

Opening slide: Fast Cryptography in Genus 2

EuroCrypt2013, Caravel Hotel, Athens, Greece, May 27, 2013

Fast Cryptography in Genus 2

Opening slide: 5 slides on hyperelliptic curve cryptography

Crypto/Security forum, Microsoft Research, Redmond, USA, March 8, 2013

5 slides on hyperelliptic curve cryptography

Opening slide: Efficient arithmetic on Jacobians of genus 2 curves

Joint Mathematics Meetings (JMM), San Diego, USA, January 12, 2013

Efficient arithmetic on Jacobians of genus 2 curves

Opening slide: Efficient pairing computation at the 192-bit and 256-bit security levels

Invited talk, ECC2012, Queretaro, Mexico, October 30, 2012

Efficient pairing computation at the 192-bit and 256-bit security levels

Opening slide: A tribute to Pierrick – Parts 1 and 2… and a tribute to Culture Club

Rump session talk, ECC2012, Queretaro, Mexico, October 29, 2012

A tribute to Pierrick – Parts 1 and 2… and a tribute to Culture Club

Opening slide: An introduction to elliptic curves and the computation of cryptographic pairings

Introductory course on elliptic curve cryptography, ECC2012, Queretaro, Mexico, October 28, 2012

An introduction to elliptic curves and the computation of cryptographic pairings

Opening slide: Fast implementations in genus 2

Ei/Psi seminar in Utrecht, the Netherlands – October 21, 2012

Fast implementations in genus 2

End of internship talk at Microsoft Research, Redmond, USA – August 14, 2012

Fast crypto in genus 2

Opening slide: Pairings for Cryptographers

Talk at Microsoft Research, Redmond, USA – Aug 15, 2012

Pairings for Cryptographers

Opening slide: Finding optimal elliptic curves for high-security pairings

Talk at Microsoft Research, Redmond, USA – June 21, 20

Finding optimal elliptic curves for high-security pairings

Opening slide: Fast formulas for computing cryptographic pairings

Phd final (defense) seminar, Queensland University of Technology, Australia, May 21, 2012

Fast formulas for computing cryptographic pairings

Opening slide: Attractive subfamilies of BLS curves for implementing high-security pairings

IndoCrypt2011, Ramanujan Auditorium, Institute of Mathematical Sciences, Chennai, India, December 13, 2011

Attractive subfamilies of BLS curves for implementing high-security pairings

Opening slide: Computing cryptographic pairings – the state of the art

Seminar at University of California, Irvine, November 2, 2010

Computing cryptographic pairings – the state of the art

LatinCrypt2010, Baroque Hall, Puebla, Mexico, August 9, 2010

Fixed argument pairings

Opening slide: An introduction to computing cryptographic pairings

Invited talk at Izmir Yasar University, Izmir, Turkey, July 1, 2010

An introduction to computing cryptographic pairings

Opening slide: Delaying mismatched field multiplications in pairing computation

WAIFI 2010, Istanbul, Turkey, June, 2010

Delaying mismatched field multiplications in pairing computation

Opening slide: Faster pairing computations on curves with high-degree twists

PKC2010, Ecole Normale Superieure, Paris, France, May 27, 2010

Faster pairing computations on curves with high-degree twists

Opening slide: Avoiding full extension field arithmetic in pairing computations

Africacrypt2010, Stellenbosch Institute for Advanced Studies, Stellenbosch, South Africa, May 4, 2010

Avoiding full extension field arithmetic in pairing computations

Opening slide: Faster pairings on special Weierstrass curves