Cryptography Reference
In-Depth Information
Similarly,
g
nV
+
nW
(
X
)
g
nV
(
X
)
g
nW
(
X
d
(
V
+
nU, W
)=
−
V
−
nU
)
g
nV
+
nW
(
X
)
g
nV
(
X
)
g
nW
(
X
g
nW
(
X − V
)
g
nW
(
X
=
−
V
)
−
V
−
nU
)
=
d
(
V,W
)
e
n
(
nU, nW
)
,
where the last equality uses the definition of the Weil pairing (Equation
(11.6)).
LEMMA 11.23
d
(
U, V
)
d
(
V,U
)
=
d
(
V,W
)
d
(
U
+
W, V
)
d
(
V,U
+
W
)
d
(
W, V
)
.
PROOF
The definition of
d
applied twice yields
g
nU
+(
nV
+
nW
)
(
X
)=
d
(
U, V
+
W
)
g
nU
(
X
)
g
nV
+
nW
(
X
−
U
)
=
d
(
U, V
+
W
)
g
nU
(
X
)
d
(
V,W
)
g
nV
(
X
−
U
)
g
nW
(
X
−
U
−
V
)
.
Similarly,
g
(
nU
+
nV
)+
nW
(
X
)=
d
(
U
+
V,W
)
g
nU
+
nV
(
X
)
g
nW
(
X − U − V
)
=
d
(
U
+
V,W
)
d
(
U, V
)
g
nU
(
X
)
g
nV
(
X
−
U
)
g
nW
(
X
−
U
−
V
)
.
Since
g
nU
+(
nV
+
nW
)
=
g
(
nU
+
nV
)+
nW
, we can cancel like terms and obtain
d
(
U, V
+
W
)
d
(
V,W
)=
d
(
U
+
V,W
)
d
(
U, V
)
.
(11.11)
Interchange
U
and
V
in (11.11) and divide to obtain
d
(
U, V
)
d
(
V,U
)
=
d
(
U, V
+
W
)
d
(
V,W
)
d
(
V,U
+
W
)
d
(
U, W
)
.
(11.12)
Now switch
V
and
W
in 11.11, solve for
d
(
U, W
), and substitute in (11.12) to
obtain the result.
LEMMA 11.24
Let
S, T ∈ E
[
n
]
.Then
e
n
(
S, T
)=
c
(
S, T
)
c
(
T,S
)
.
PROOF
Choose
U, V ∈ E
[
n
2
]sothat
nU
=
S, nV
=
T
. The left-hand
side of the formula in the previous lemma does not depend on
W
. Therefore
Search WWH ::
Custom Search