Cryptography Reference
In-Depth Information
Algorithm 13.3:
The
η
algorithm
Input
:
P
=
(
x
P
,
y
P
)
∈
G
1
and
Q
=
(
x
Q
,
y
Q
)
∈
G
2
Output
:
e
(
P
,
Q
)
∈
G
T
1
f
←
1
2
for
i
=
1
upto
m
do
3
x
P
,
y
P
y
P
x
P
←
←
μ
←
x
P
+
x
Q
4
λ
←
μ
+
x
P
x
Q
+
y
P
+
y
Q
+
b
5
t
2
g
←
λ
+
μ
t
+
(μ
+
1
)
6
f
←
f
·
g
7
x
1
/
2
Q
y
1
/
2
Q
x
Q
←
,
y
Q
←
8
9
end
10
return
f
q
2
−
1
Algorithm 13.4:
The
η
G
algorithm
Input
:
P
=
(
x
P
,
y
P
)
∈ G
1
and
Q
=
(
x
Q
,
y
Q
)
∈ G
2
Output
:
e
(
P
,
Q
)
∈
G
T
f
←
1
1
2
T
←
P
3
for
i
=
1
upto
m
do
λ
←
x
T
+
1
4
t
2
u
←
(
y
Q
+
y
T
+
λ(
x
Q
+
x
T
+
1
))
+
(λ
+
x
Q
+
q
)
t
+
(λ
+
x
Q
+
1
)
5
t
2
v
←
(
x
Q
+
x
T
+
1
)
+
t
+
6
f
2
u
v
←
·
f
7
T
←[
2
]
T
8
9
end
10
return
f
y
2
x
3
E
:
+
y
=
+
x
+
b
s
2
t
2
with
b
∈ F
2
.If
F
q
2
= F
q
[
s
]
/(
+
s
+
1
)
and
F
q
4
= F
q
2
[
t
]
/(
+
t
+
s
)
then
s
2
the distortion map
φ
:
E
(
F
q
)
→
E
(
F
q
4
)
is defined by
φ(
x
,
y
)
=
(
x
+
,
y
+
t
5
and that
t
satisfies
t
4
sx
+
t
)
. Note that
s
=
=
t
+
1, so we can also represent
t
4
F
q
4
as
F
q
[
t
]
/(
+
t
+
1
)
. Then, by setting
G
1
= G
2
=
E
(
F
q
)
and
G
T
= F
q
4
,
Algorithms 13.3 and 13.4 compute admissible symmetric pairings.
13.2.4 The Ate Pairings
The ate pairing was introduced by Hess et al. [181] and generalises the
η
-pairing
to ordinary elliptic curves. The main difference between the Tate and
η
-pairings is
that the arguments are swapped, i.e., the ate pairing is defined on
G
2
× G
1
. Further-
