$\newcommand{\F}{\mathbb{F}}$ Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. Say $G_T \leq \F_{q^k}^\times$ and the pairing is $e : G_1 \times G_2 \to G_T$.

Suppose $p = |G_1|$ is prime. My question is the following: how does $e$ behave on points in $G_2$ which are off the distinguished order $p$ subgroup?

Here is a guess: Let $G_1 = \langle g \rangle$ and $G_2 =\langle h \rangle \times K$ where $h$ has order $p$. My guess would be that for $k \in K$ we have $e(g^a, h^b k) = e(g^a, h^b)$. Is it correct that off subgroup components are "killed" when paired with a $G_1$ element?

  • 1
    $\begingroup$ I think this depends not just on the pairing itself but on the implementation formulae. It may be useful to specify whether additions and line evaluations in the Miller loop are using complete formulae. $\endgroup$ – Daira Hopwood Apr 15 '19 at 1:04
  • $\begingroup$ Ah hm -- I guess I am interested in the answer to the question when using formulae which are guaranteed to give well defined results for all points on $E'$. This is at least the 'easiest' form of this question. $\endgroup$ – Izaak Meckler Apr 15 '19 at 21:28
  • 1
    $\begingroup$ I briefly posted a partial answer and then realised it may be completely wrong. Need to check an assumption I made. $\endgroup$ – Daira Hopwood Apr 22 '19 at 9:32
  • 1
    $\begingroup$ What was the gist of the partial answer? Maybe it will spark further thoughts even if it was partial :) $\endgroup$ – Izaak Meckler Apr 27 '19 at 6:59
  • $\begingroup$ Still checking. In the meantime you may be interested in github.com/zcash/zcash/issues/3425#issuecomment-487320929 and the subsequent comments. $\endgroup$ – Daira Hopwood Apr 28 '19 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.