Divisors - Elliptic Curves: Number Theory and Cryptography - page 356

Notethatoncewehavechosen D P , the function f is determined up to a

constant multiple. Since 0 = deg( D Q )= i a i , any such constant cancels out
in the definition of the pairing.
We need to see what happens when we change the choice of D P or D Q .
Suppose D P and D Q are divisors of degree 0 with sums P and Q ,andthat
φ ( D Q )= D Q and φ ( D P )= D P .Then

D P = D P + div( g ) , D Q = D Q + div( h ) ,

for some functions g and h . By Lemma 11.10, we may assume that g, h are
defined over F q .Wehavediv( f )= nD P

for some function f

defined over

F q .
First, assume that D Q hasnopointsincommonwith D P and D P and that

D P

also has no points in common with D Q .Since

div( f )=div( fg n ) ,

f = cfg n for some constant c . Let's use f and D Q to define a pairing, and
denote it by · , · n .Weobtain

P, Q n = f ( D Q )= f ( D Q ) g ( D Q ) n = f ( D Q ) f (div( h )) g ( D Q ) n .

Note that the constant c canceled out since deg( D Q ) = 0. We now need the
following result, which is usually called Weil reciprocity .

LEMMA 11.11
Let f and h be two functions on E and suppose that div( f ) and div( h ) have
no pointsincommon.Then

f (div( h )) = h (div( f )) .

For a proof, see [59, p. 427] or [109].
In our situation, Weil reciprocity yields

n = f ( D Q ) h (div( f )) g ( D Q ) n
= f ( D Q ) h ( D P ) n g ( D Q ) n .

P, Q

Since φ ( h ( D P )) = h ( φ ( D P )) = h ( D P ) and similarly for g ( D Q ), we have
h ( D P ) ,g ( D Q ) ∈ F q . Therefore,

P, Q n ≡P, Q n

(mod ( F q ) n ) ,

so the pairing is independent mod n th powers of the choice of D P and D Q .
For the general case where D P ,D P and D Q ,D Q could have points in com-
mon, use Lemma 11.9 to choose disjoint divisors D P and D Q that are disjoint

from all of these divisors. Then

P, Q n ≡P, Q n ≡P, Q n (mod ( F q ) n ) .