# Order of target group in bilinear pairing

Consider a bilinear pairing $e:G_1×G_2→G_T$, and $p^2q^2$ be the order of $G_1$ and $G_2$, where $p$ and $q$ are prime integers.

Suppose that $g_1$ and $g_2$ are generators of $G_1$ and $G_2$ respectively, and $a$ is a random integer. What is the output of $e(g_1^p, g_2^a)$? Is it equal to $(g_t)^{ap}$?

What is the order of the result? Is it equal to $pq^2$?

I know usually in the pairing cryptography the order of groups is set to a prime integer, but, i just want to know what happens if the order is a composite integer $p^2q^2$.

• Do you know that such a pairing exists? – fkraiem Dec 19 '16 at 12:47
• And while we're at it, you speak of the "embedding degree". I seem to have forgotten what it is; can you remind me? – fkraiem Dec 19 '16 at 12:51
• I do not see a definition of the term "embedding degree" in that link... What I'm trying to get at is, you seem to have only a faint idea of what you are talking about, so I suggest you refer to a serious source, such as for example the book of Hoffstein-Pipher-Silverman. – fkraiem Dec 19 '16 at 14:16
• Ah, found it, it's buried in the middle of a big wall of text.... It says "it’s the degree of the extension of $\mathrm{GF}(q)$ which lets us have a subgroup of $\mathrm{GF}(q^k)^*$ that’s isomorphic to $G_1$." That will do, so what do you not uderstand? – fkraiem Dec 19 '16 at 14:20
• For your second question "what is the order of $e(aQ, pQ)$, here's a hint: what's $q \cdot e(aQ, pQ)$ ? – poncho Dec 19 '16 at 16:25

I find it. The output is $e(g_1^p,g_2^a)=(g_t)^{ap}$. https://eprint.iacr.org/2013/812.pdf 