I'm new to cryptography and I am working on R-ate Pairings on a BN Curve:
$y^2=x^3+b$ with $b$=5
with its M-type twist:
$y^2=x^3+b\beta$, and $\beta^2 = -2$.
The base finite field characteristic is P
Now, according to the paper, there is a Frobenius endomorphism
$\pi^p:(x,y)\longmapsto(x^p,y^p)$
So, for a given point:
$Q(x,y)$ on $y^2=x^3+5\beta$,
Its Frobenius map $Q`(x^p,y^p)$ should also have $(y^p)^2=(x^p)^3+5\beta$.
My calculation shows the results is $(y^p)^2=(x^p)^3-5\beta$
So where am I going wrong?
Thanks for your help.
Reference of the paper (in Chinese):
Translation of algorithm image:
$\pi_q$ as Frobenius endomorphism, $\pi_q: E \rightarrow E$, $\pi_q(x,y) = (x^q,y^q)$
$\pi_{q^2}: E \rightarrow E$, $\pi_{q^2}(x,y) = (x^{q^2},y^{q^2})$
R-ate pairing ("pair's calculation"):
Input: $P \in \mathbb{E(\mathbb{F_p}})[r], Q \in \mathbb{E'(\mathbb{F_{p^2}})}[r]$, $a = 6t+2$
Output: $R_a(Q,P)$
a) Let $a = \sum_{i=0}^{L-1}a_i 2^i, a_{L-1}=1$
b) Set $T=Q, f=1$
c) With $i$ from $L-2$ down until 0, execute:
c.1) calculate $f = f^2 \cdot g_{T,T}(P), T=[2]T$
c.2) if $a_i = 1$, compute $f = f\cdot g_{T,Q}(P), T = T+Q$
d) Compute $Q_1 = \pi_q(Q), Q_2=\pi_{q^2}(Q)$
e) compute $f = f\cdot g_{T,Q_1}(P), T = T+Q_1$
f) compute $f = f\cdot g_{T,-Q_2}(P), T = T-Q_2$
g) compute $f = f^{(q^{12}-1)/r}$;
h) output $f$.
Edit:
In step d) $Q_1$ is a point after applying the Frobenius map on $Q$. Then in step e) there is $T=T+Q_1$ Confusion: According my calculation above, $Q_1$ should not be on the same curve where $T$ is. Is it correct to calculate $T=T+Q_1$? Or is my calculation wrong?
