Re: Problem: the Tate pairing function does not preserve bilinearity properties

[Aleksandr Lenin <aleksandr.lenin@cyber.ee>]

it was my wrong assumption that Sage was calling elltatepairing directly
without any further postprocessing, which has brought me to the idea
that elltatepairing gives me the reduced tate pairing value, which was
obviously wrong. Thanks for pointing this out.

After making the reduction manually, I got the correct results.

Thanks a lot, Bill!

On 03/02/2018 02:31 PM, Bill Allombert wrote:
> On Fri, Mar 02, 2018 at 02:22:26PM +0200, Aleksandr Lenin wrote:
>> Hi all,
>>
>> I've stumbled across the following problem and need an advice - am I
>> missing something here, or did I understand something wrong?
>>
>> [Problem description]
>>
>> Consider a supersingular elliptic curve y^3 = x^2 + 1 defined over an
>> extension field F_{59^2}. Consider two points P and Q belonging to to
>> different subgroups of the 5-torsion.
>>
>> P = (28,51) is the point residing in the base field subgroup
>> Q = (23*x+45,51) is the point obtained by applying the distortion map to P.
>>
>> I am checking for bilinearity property: e([2]P,Q) = e(P,Q)^2
> 
> Hello Aleksandr,
> 
> This is not true for the non-reduced Tate pairing returned by PARI.
> This formula holds only modulo the 5-powers:
> 
> a=ffgen((a^2+1)*Mod(1,59));
> E=ellinit([0,1],a);
> P=[28,51];DP=[18,13];Q=[23*a+45,51];
> ? l=(59^2-1)/5
> elltatepairing(E,P,Q,5)^2/elltatepairing(E,DP,Q,5)
> %26 = 8*a
> ? (elltatepairing(E,P,Q,5)^2/elltatepairing(E,DP,Q,5))^l
> %28 = 1
> 
> Sage returns the reduced Tate pairing instead,
> which is elltatepairing(E,P,Q,5)^l
> 
> One good reference is
> https://hal.inria.fr/hal-00767404v2/document
> 
> Cheers,
> Bill.
> 

-- 
Aleksandr