# How should I define order according to domain parameters in elliptic curve pairing groups?

According to domain parameters, as an example Type 1 pairing domain parameters are

type a
q 27879613696961117336138104309456294826479066237082592266147038816013737491804164520572553699557553630981482283688199917967118528442239571468038223146350512716655640686574646971805525067560602493473605950050724367056555427793982219494494533985075071293605883935405449574693139267144620339147780011932034570971
r 6703903964971298549787012499102923063739682910296196688861780721860882015036773488400937149083451713845015929093243025426876941405973284973216824503566337
h
4158713168123445580277356330123491616648662731352560789333036543154928645632846280639115948806843941261964661880479762215130625902691650289531941682715356
exp1 19
exp2 511
sign0 1
sign1 1


How can we define the order of system parameters?
Order for generator $P\in\mathbb{G}_1$?
Order of random secret key $s$ from $Zr$?

• Not entirely sure what you're asking here. This is a "Type A" supersingular curve according to the dichotomy presented in Benn Lynn's thesis. We have $E(\mathbb{F}_q) : y^2 = x^3 + x$, where $\mathbb{G}_1 = \mathbb{G}_2 = E(\mathbb{F}_q)[r]$ and $\mathbb{G}_T$ is the subgroup of $r$th roots of unity of $\mathbb{F}_{q^2}^\ast$. Here $r = 2^{511} + 2^{19} + 1$. So $r$ is the order of the elements of $\mathbb{G}_1, \mathbb{G}_2,$ and $\mathbb{G}_T$. – Samuel Neves Jul 3 '16 at 10:01

I think you should probably specify more details about the current curve, or give more insight about the parameters you are choosing, eg: is this a curve over $GF(p)$ or is this a curve over $GF(2^m)$. What is your $r$ value? Without such detail I can't give a very accurate answer but the order of the subgroup generated by a given point $P$, $<P>$ can be calculated from a combination of bruteforcing and checking the divisors of the number of elements inside the original curve (Since these are cyclic groups you really only need to apply lagrange theorem and check if the current divisor $d$ of $n$ satisfies $P^d = O$). There are polynomial time algorithms to retrieve the order of the original curve group (check Schoof's algorithm).