I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the Pairing Based Cryptography Library, there is only a single supersingular elliptic curve implemented, which is a Type A curve. However, he also mentions that type E curves provide the possibility of a symmetric pairing. I am unclear as to how this works, and how to generate such a curve that is a symmetric pairing to be used in schemes like CPABE, as the thesis only explains arbitrary Type E curves.

  • $\begingroup$ The usual word for non-supersingular is ordinary. $\endgroup$
    – minar
    Commented Jul 7, 2013 at 19:10

1 Answer 1


This case for symmetric pairing was mentioned in http://eprint.iacr.org/2001/003.

To sum the results given in that paper, you can get symmetric pairing in a few cases:

  1. Trace 2 ordinary curves over where $p-1$ is square-free. In this case, the Tate pairing is non-degenerate for all points. Unfortunately, there is no known way to build such curves.
  2. Trace 2 ordinary curves where $p-1$ contains a large square factor $\ell^2$. These are the Type E curves you mention, which are constructed using complex multiplication. In this case, depending on the considered parameters, there might or might not exist non-zero $\ell$-torsion points $P$ with $e(P,P)=1$. Note that, even when they exists, there are at most $2(\ell-1)$ such points.
  3. Supersingular curve. Here $e(P,P)=1$ for $P$ defined in the basefield, but you can use a distorsion map $\psi$ and compute $e(P,\psi(P))$. This is the most frequent construction used for symmetric pairings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.