tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/845e96c20e5a5ff3b03f4caf72c3cb817a7fa542/pdf

However on page 388 he states the following equality which I don't see why it is true: $F_W(a,P_b,Q_c) = F_W(a,Q_b, P_c)$

where $F_W(x,y,z)= e_m(y,z)^x$. For me the first value of the equality is the inverse of the second one?

This does indeed appear to be a typo. Using that $e_m$ is bilinear and alternating, one calculates \begin{align*} F_W(a,P_b,Q_c) \;&=\; e_m([b]P,[c]Q)^a \\&=\; e_m(P,Q)^{abc} \\&=\; e_m(Q,P)^{-abc} \\&=\; e_m([b]Q,[c]P)^{-a} \\&=\; F_W(a,Q_b,P_c)^{-1} \text. \end{align*}
(However, note that these are only different if the order of $e_m(P,Q))$ does not divide $abc$; in particular, we need $e_m(P,Q)\neq1$.)
• I don't see that this is true. Is $e_m(P,Q)=e_m(Q,P)^{-1}$ some inherent property of the Weil pairing? Can you clarify this step? Jun 19 '16 at 15:00
• @ArtjomB. I suppose that by "trick", you refer to writing $H(i)$ as a power of $g$? In that case, the same method is not applicable here: The points $P$ and $Q$ are assumed to be independent, i.e., $e_m(P,Q)\neq1$, and this implies they are not a multiple of the same point by the properties of the Weil pairing. Jun 26 '16 at 15:06