# tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/845e96c20e5a5ff3b03f4caf72c3cb817a7fa542/pdf

However on page 388 he states the following equality which I don't see why it is true: $F_W(a,P_b,Q_c) = F_W(a,Q_b, P_c)$

where $F_W(x,y,z)= e_m(y,z)^x$. For me the first value of the equality is the inverse of the second one?

## 1 Answer

This does indeed appear to be a typo. Using that $e_m$ is bilinear and alternating, one calculates \begin{align*} F_W(a,P_b,Q_c) \;&=\; e_m([b]P,[c]Q)^a \\&=\; e_m(P,Q)^{abc} \\&=\; e_m(Q,P)^{-abc} \\&=\; e_m([b]Q,[c]P)^{-a} \\&=\; F_W(a,Q_b,P_c)^{-1} \text. \end{align*}

(However, note that these are only different if the order of $e_m(P,Q))$ does not divide $abc$; in particular, we need $e_m(P,Q)\neq1$.)

• thank you! that's exactly what I thought! for the second part of your answer notice that P and Q are supposed to be independant ,hence the Weil pairing of these two points is a primitive root of unity. Jun 19 '16 at 14:26
• I don't see that this is true. Is $e_m(P,Q)=e_m(Q,P)^{-1}$ some inherent property of the Weil pairing? Can you clarify this step? Jun 19 '16 at 15:00
• yes this property can be shown to be true for every point of m-torsion. This is called the alternating property. see here: crypto.stanford.edu/pbc/notes/elliptic/weil.html Jun 19 '16 at 15:11
• I see. So, does this mean that my answer here is wrong? The trick I've used there would also be applicable to this question and would mean that the equality is actually true. Jun 20 '16 at 13:34
• @ArtjomB. I suppose that by "trick", you refer to writing $H(i)$ as a power of $g$? In that case, the same method is not applicable here: The points $P$ and $Q$ are assumed to be independent, i.e., $e_m(P,Q)\neq1$, and this implies they are not a multiple of the same point by the properties of the Weil pairing. Jun 26 '16 at 15:06