# Order of target group in pairing

Let $N=pq$, where $p$ and $q$ are prime numbers, and order of $G_1$ and $G_2$ is equal to $p$. Suppose that $e(G_1, G_2)=G_t$ is a pairing of composite order. I know that, usually the order of target group $G_t$ is $p$.

Is it possible to set the order of target group to $pq$? In other words, is it possible to set order of target group be bigger that the order domain groups?

(I write $G_n$ for an abelian group of order $n$.)

Well, you can always embed $G_p$ into a group of order $pq$ as a subgroup, but that is probably not what you want.

Besides such trivial cases, this is impossible: The universal property of tensor products uniquely factors any bilinear map $e\colon\ G_p\times G_p\to G_{pq}$ as $$e\colon\;G_p\times G_p\twoheadrightarrow G_p\otimes_{\mathbb Z}G_p\xrightarrow{\bar e}G_{pq} \text;$$ note in particular that $\bar e$ has the same image as $e$. However, since $p$ is prime, $G_p$ is cyclic and $G_p\otimes_{\mathbb Z}G_p\cong G_p$ via the map $a\otimes b\mapsto ab$; thus $\operatorname{im}e=\operatorname{im}\bar e$ has order dividing $p$.

This essentially shows that any such pairing $e$ is either degenerate or given by a pairing $G_p\times G_p\to G_p$ followed by an embedding.

Here is a more elementary proof, using only basic group theory and bilinearity: Let $e\colon\ G_p\times G_p\to G_{pq}$ be a bilinear pairing and $g$ a generator of $G_p$. Since $e(g^n,g^m)=e(g,g)^{nm}$ for any $n,m\in\mathbb Z$, the element $e(g,g)$ is a generator of the image of $e$. But $$e(g,g)^p=e(g,g)^p=e(g^p,g)=e(1,g)=e(g^0,g)=e(g,g)^0=1\text,$$ thus the order of $e(g,g)$ divides $p$. This implies (as $p$ is prime) that the image of $e$ is either trivial or isomorphic to $G_p$; in particular $e$ is never surjective.

• Explain it, please. What is $\bar e$? I have no idea about $\operatorname{im}e$ and difference of $\mapsto$ and $\twoheadrightarrow$. Dec 25 '16 at 12:43
• @Majid I added a simpler proof. For reference: $\bar e$ is the induced map from the tensor product as indicated in the displayed diagram; $\operatorname{im}$ denotes the image set/group of a map; and the arrow $\twoheadrightarrow$ symbolizes a surjective map. Dec 25 '16 at 14:57
• ok, this map is not surjective, but degenerate? Dec 26 '16 at 6:50
• You said that $G_p \times G_p \rightarrow G_{pq}$ can be given by a pairing $e:G_p \times G_p \rightarrow G_p$ followed by an embedding. Please explain it. Dec 26 '16 at 6:57
• would you please explain this "any such pairing $e$ is either degenerate or given by a pairing $G_p×G_p→G_p$ followed by an embedding" Dec 28 '16 at 5:59