Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the Pairing Based Cryptography Library, there is only a single supersingular elliptic curve implemented, which is a Type A curve. However, he also mentions that type E curves provide the possibility of a symmetric pairing. I am unclear as to how this works, and how to generate such a curve that is a symmetric pairing to be used in schemes like CPABE, as the thesis only explains arbitrary Type E curves.

share|improve this question
The usual word for non-supersingular is ordinary. –  minar Jul 7 '13 at 19:10

1 Answer 1

This case for symmetric pairing was mentioned in

To sum the results given in that paper, you can get symmetric pairing in a few cases:

  1. Trace 2 ordinary curves over where $p-1$ is square-free. In this case, the Tate pairing is non-degenerate for all points. Unfortunately, there is no known way to build such curves.
  2. Trace 2 ordinary curves where $p-1$ contains a large square factor $\ell^2$. These are the Type E curves you mention, which are constructed using complex multiplication. In this case, depending on the considered parameters, there might or might not exist non-zero $\ell$-torsion points $P$ with $e(P,P)=1$. Note that, even when they exists, there are at most $2(\ell-1)$ such points.
  3. Supersingular curve. Here $e(P,P)=1$ for $P$ defined in the basefield, but you can use a distorsion map $\psi$ and compute $e(P,\psi(P))$. This is the most frequent construction used for symmetric pairings.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.