# How do pairings behave on G2/twist points off the prime order subgroup?

$$\newcommand{\F}{\mathbb{F}}$$ Consider the ate pairing defined on a curve $$G_1 = E(\F_q)$$ and $$G_2 = E'(\F_{q^r})$$ where $$E'$$ is a twist of $$E$$ with the twisting isomorphism defined over $$\F_{q^r}$$. Say $$G_T \leq \F_{q^k}^\times$$ and the pairing is $$e : G_1 \times G_2 \to G_T$$.

Suppose $$p = |G_1|$$ is prime. My question is the following: how does $$e$$ behave on points in $$G_2$$ which are off the distinguished order $$p$$ subgroup?

Here is a guess: Let $$G_1 = \langle g \rangle$$ and $$G_2 =\langle h \rangle \times K$$ where $$h$$ has order $$p$$. My guess would be that for $$k \in K$$ we have $$e(g^a, h^b k) = e(g^a, h^b)$$. Is it correct that off subgroup components are "killed" when paired with a $$G_1$$ element?

• I think this depends not just on the pairing itself but on the implementation formulae. It may be useful to specify whether additions and line evaluations in the Miller loop are using complete formulae. – Daira Hopwood Apr 15 at 1:04
• Ah hm -- I guess I am interested in the answer to the question when using formulae which are guaranteed to give well defined results for all points on $E'$. This is at least the 'easiest' form of this question. – Izaak Meckler Apr 15 at 21:28
• I briefly posted a partial answer and then realised it may be completely wrong. Need to check an assumption I made. – Daira Hopwood Apr 22 at 9:32
• What was the gist of the partial answer? Maybe it will spark further thoughts even if it was partial :) – Izaak Meckler Apr 27 at 6:59
• Still checking. In the meantime you may be interested in github.com/zcash/zcash/issues/3425#issuecomment-487320929 and the subsequent comments. – Daira Hopwood Apr 28 at 1:40