According to domain parameters, as an example Type 1 pairing domain parameters are

type a
q 27879613696961117336138104309456294826479066237082592266147038816013737491804164520572553699557553630981482283688199917967118528442239571468038223146350512716655640686574646971805525067560602493473605950050724367056555427793982219494494533985075071293605883935405449574693139267144620339147780011932034570971
r 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503566337
exp1 19
exp2 511
sign0 1
sign1 1

How can we define the order of system parameters?
Order for generator $P\in\mathbb{G}_1$?
Order of random secret key $s$ from $Zr$?

  • $\begingroup$ Not entirely sure what you're asking here. This is a "Type A" supersingular curve according to the dichotomy presented in Benn Lynn's thesis. We have $E(\mathbb{F}_q) : y^2 = x^3 + x$, where $\mathbb{G}_1 = \mathbb{G}_2 = E(\mathbb{F}_q)[r]$ and $\mathbb{G}_T$ is the subgroup of $r$th roots of unity of $\mathbb{F}_{q^2}^\ast$. Here $r = 2^{511} + 2^{19} + 1$. So $r$ is the order of the elements of $\mathbb{G}_1, \mathbb{G}_2,$ and $\mathbb{G}_T$. $\endgroup$ Commented Jul 3, 2016 at 10:01

1 Answer 1


I think you should probably specify more details about the current curve, or give more insight about the parameters you are choosing, eg: is this a curve over $GF(p)$ or is this a curve over $GF(2^m)$. What is your $r$ value? Without such detail I can't give a very accurate answer but the order of the subgroup generated by a given point $P$, $<P>$ can be calculated from a combination of bruteforcing and checking the divisors of the number of elements inside the original curve (Since these are cyclic groups you really only need to apply lagrange theorem and check if the current divisor $d$ of $n$ satisfies $P^d = O$). There are polynomial time algorithms to retrieve the order of the original curve group (check Schoof's algorithm).

  • $\begingroup$ JOÃO MARQUES. Pairings are constructed on the curve y2 = x3 + x over the field F_q for some prime q = 3 mod 4. Both G1 and G2 are the group of points E(F_q), so this pairing is symmetric. It turns out #E(F_q) = q + 1 and #E(F_q2) = (q + 1)2. Thus the embedding degree k is 2, and hence GT is a subgroup of F_q^2. The order r is some prime factor of q + 1. Write q + 1 = r * h. For efficiency, r is picked to be a Solinas prime, that is, r has the form 2a +- 2b +- 1 for some integers 0 < b < a. $\endgroup$
    – mimi
    Commented Mar 4, 2016 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.