Posts  / #POST-218409
REDDIT

What s the shortest possible number of Miller loops for bn254 and bls12-381 elliptic curves for getting a bilinear pairing?

A
Jan 30, 2026 · 19:28

There s many paper that explore making bilinear pairings efficient, but as far I understand, they also aim at making the final exponentiation simpler.

In my case I [have an inversion algorithm whose complexity is if I understand correctly O(k(2^(s^²)))^(3.3k))](https://drive.google.com/file/d/1SXS1h-6Tywdj9_1XlMRhrS0piHl7DrLG/view). Where *k* is the embdedding degree and *s* is the number of Miller loop iterations. This in turns means the time spent in the final exponentiation is mostly irrelevant.