Divisors - Elliptic Curves: Number Theory and Cryptography - page 358

a little care is needed to avoid massive calculations. Also, the definition given
for the Weil pairing involves a function g whose divisor includes contributions
from all of the n 2 points in E [ n ]. When n is large, this can cause compu-
tational di culties. The following result gives an alternate definition of the
Weil pairing e n .

THEOREM 11.12
Let S, T

∈ E [ n ] .Let D S and D T be divisors of degree 0 such that

sum( D S )= S sum( D T )= T

and

and such that D S and D T have no pointsin common. Let f S and f T be
functions such that

div( f S )= nD S div( f T )= nD T .

and

Then the W eilpairing isgiven by

e n ( S, T )= f T ( D S )

f S ( D T ) .

(R ecallthat f ( a i [ P i ]) = i f ( P i ) a i .)

The proof is given in Section 11.6.1.

REMARK 11.13 Some authors define the Weil pairing as f S ( D T ) /f T ( D S ),
thus obtaining the inverse of the value we use.

A natural choice of divisors is

D S =[ S ] − [ ∞ ] , D T =[ T + R ] − [ R ]

for some randomly chosen point R .Thenwehave

f S ( R ) f T ( S )

e n ( S, T )=

f S ( T + R ) f T ( ∞ ) .

Example 11.5
Let E be the elliptic curve over F 7 defined by

y 2 = x 3 +2 .

Then

E ( F 7 )[3] Z 3 ⊕ Z 3 .

In fact, this is all of E ( F 7 ). Let's compute

e 3 ((0 , 3) , (5 , 1)) .