# Can cryptographically useful pairings only be used with elliptic curves?

As far as I understand one big advantage of ECC is that we can use pairings on the group of torsion points of the curve. I was wondering if it is possible to construct pairings from general finite fields $\mathbb F_q$? If not on finite fields $\mathbb F_q$ are there other structures in cryptography where pairings are used?

• A pairing is just a $R$-bilinear map $e: M \times N \to L$, where $R$ is a commutative ring with unity and $M,N,L$ are $R$-modules. Many kinds of pairings exist, for example the usual dot-product is a pairing. Whether such pairings are useful to cryptography (i.e., whether they can lead to useful cryptographic assumptions) is another question, and probably the one you had in mind (hence why this is not an answer). – fkraiem Oct 14 '15 at 8:49
• Indeed, my question was if there are useful pairings in cryptography over finite fields. – user28082 Oct 14 '15 at 11:30
• One can define pairings on Jacobians of hyperelliptic curves. But I never did any further study on those objects, because IMHO hyperelliptic curve cryptography is a dead end. – user27950 Oct 15 '15 at 17:16
• @Cryptostasis Indeed, there is one library that implements pairings on hyperelliptic curves. – Artjom B. Oct 16 '15 at 18:49
• I said hyperelliptic and not elliptic – user27950 Apr 3 '18 at 16:42