What's the difference between Optimal ate pairing and R-ate pairing?

Question

I compare the algorithm description of Optimal ate pairing and R-ate pairing, it turns out to me that the formulas are the same. So I'm a little confused, what's the difference between them? or is it just I misunderstand? Thanks very much.

ref: Beuchat J L, González-Díaz J E, Mitsunari S, et al. High-speed software implementation of the optimal ate pairing over Barreto–Naehrig curves[C]//International Conference on Pairing-Based Cryptography. Springer, Berlin, Heidelberg, 2010: 21-39.

ref: SM9 identity-based cryptographic algorithms Part 1: General Page32-33 http://www.gmbz.org.cn/upload/2018-04-04/1522794739303068173.pdf

Answer 1

In the paper by Beuchat et al. the optimized ate pairing for a BN curve is defined as

This definition is consistent across may different papers by different authors. Meanwhile the efficient R-ate pairing defined in the origial paper

Eunjeong Lee, Hyang-Sook Lee, and Cheol-Min Park. Efficient and generalized pairing computation on abelian varieties. Cryptology ePrint Archive, Report 2008/040, 2008. http://eprint.iacr.org/2008/040.

is defined there for BN curves as

Just by looking at their definitions the two pairings appear to be different, although they do have a common factor as the Miller function $f_{6t+2,Q}(P)$. However, unless there is some strange identity applicable, I do not see that these definitions are equivalent. The most striking differences are that the R-ate pairing requires evaluation of two Miller functions and that the exponentiations are very different.

Additionally, the authors give an algorithm for computing the R-ate pairing as

which fits their definition, but is of course very different to the algorithm listed in the SM9 document. The algorithm listed in the SM9 document labeled as "R-ate pairing computation" seems to be for an optimized ate pairing.

If that is indeed how it is then we can only speculate why the SM9 document is using the wrong name for the pairing. Since the cited SM9 document is a translation of the Chinese original, it might be an translation error.

I think ultimately it does not particularly matter what they call this pairing. What is more important is that it is clearly specified which pairing is used. The optimized ate pairing seems to be effectively specified by the listed algorithm except for its name.