Re: Reduced Tate pairing in supersingular elliptic curves

[Aleksandr Lenin <aleksandr.lenin@cyber.ee>]

Hello Bill,

thank you for such a detailed explanation, much appreciated! It became
much clearer now.

-- 
Aleksandr

On 04/19/2018 01:02 AM, Bill Allombert wrote:
> On Wed, Apr 18, 2018 at 11:13:34AM +0300, Aleksandr Lenin wrote:
>> Hello Bill,
>>
>> thanks for your answer.
>>
>> On 04/18/2018 12:10 AM, Bill Allombert wrote:
>>> However E(F_q) is isomorphic to (Z/lZ)^2 with r^6 dividing l,
>                                           I meant r^3
>>> and p2 is of order r, so p2 can be written as [r].q for some point q,
>>> so the Tate pairing (p1,p2) is trivial.
>>
>> I do not completely understand the last inference about the triviality
>> of the Tate pairing.
> 
> E(F_q) is isomorphic to (Z/lZ)^2, so there are two generators g1, g2 of
> order l. Since p2 belong to E(F_q), there exist a, b, such that 
> p2= a.g1 + b.g2
> Now
> r.p2 = (r*a).g1 + (r.b)*.g2
> since r.p2 = oo then 
> r*a = 0 [l]
> r*b = 0 [l]
> Since r^2 divides l, then
> r*a = 0 [r^2]
> r*b = 0 [r^2]
> so
> a=0 [r]
> b=0 [r]
> So it existe a', b' such that
> a= r*a'
> b= r*b'
> We set q2 = a'.g1+b'.g2
> then r.q2 = p2
> 
> Now the Tate pairing is bilinear so tate_r(p1,p2) = tate_r(p1,q2)^r
> so tate_r(p1,p2)^((q-1)/r) = tate_r(p1,q2)^(q-1) = 1.
> 
> Cheers,
> Bill
>