References for optimal ate pairings.

Signed-off-by: Daira Hopwood <daira@jacaranda.org>

protocol/protocol.tex

@@ -5319,7 +5319,7 @@ $t^2 + 1$; in this representation, $\xi$ is given by $t + 9$.
 Let $\GroupG{T}$ be the subgroup of $\ParamGexp{r}{\mathrm{th}}$ roots of unity in
 $\GFstar{\ParamGexp{q}{12}}$.
 
-Let $\PairingG$ be the optimized ate pairing of type
+Let $\PairingG$ be the optimal ate pairing (see \cite{Vercauter2009} and \cite[section 2]{AKLGL2010}) of type
 $\GroupG{1} \times \GroupG{2} \rightarrow \GroupG{T}$.
 
 For $i \typecolon \range{1}{2}$, let $\ZeroG{i}$ be the point at infinity
@@ -5484,7 +5484,7 @@ $t^2 + 1$; in this representation, $i$ is given by \todo{$?$}.
 Let $\GroupS{T}$ be the subgroup of $\ParamSexp{r}{\mathrm{th}}$ roots of unity in
 $\GFstar{\ParamSexp{q}{12}}$.
 
-Let $\PairingS$ be the optimized ate pairing of type
+Let $\PairingS$ be the optimal ate pairing of type
 $\GroupS{1} \times \GroupS{2} \rightarrow \GroupS{T}$.
 
 For $i \typecolon \range{1}{2}$, let $\ZeroS{i}$ be the point at infinity in $\GroupS{i}$,
@@ -7839,6 +7839,7 @@ Daira Hopwood, Sean Bowe, and Jack Grigg.
 \subparagraph{2018.0-beta-16}
 
 \begin{itemize}
+    \item Give references \cite{Vercauter2009} and \cite{AKLGL2010} for the optimal ate pairing.
 \sapling{
     \item Correct an error in the $y$-coordinate formula for addition
           in \crossref{cctmontarithmetic} (the constraints were correct).

protocol/zcash.bib

@@ -65,6 +65,28 @@ Lecture Notes in Computer Science; Springer, 2013.},
    urldate={2016-09-01}
 }
 
+@misc{AKLGL2010,
+   presort={AKLGL2010},
+   author={Diego Aranha and Koray Karabina and Patrick Longa and Catherine Gebotys and Julio López},
+   title={Faster {E}xplicit {F}ormulas for {C}omputing {P}airings over {O}rdinary {C}urves},
+   url={https://eprint.iacr.org/2010/526},
+   urldate={2018-04-03},
+   howpublished={Cryptology ePrint Archive: Report 2010/526.
+Last revised September~12, 2011.}
+}
+
+@misc{Vercauter2009,
+   presort={Vercauter2009},
+   author={Frederik Vercauteren},
+   title={Optimal pairings},
+   url={https://eprint.iacr.org/2008/096},
+   urldate={2018-04-06},
+   howpublished={Cryptology ePrint Archive: Report 2008/096.
+Last revised March~7, 2008.},
+   addendum={A version of this paper appeared in \textsl{IEEE Transactions of Information Theory},
+Vol.~56, pages 455--461; IEEE, 2009.}
+}
+
 @misc{Groth2016,
    presort={Groth2016},
    author={Jens Groth},