Re: What’s the pari/gp function for the Miller’s algorithm ?

[Laël Cellier <lael.cellier@laposte.net>]

Le 15/03/2026 à 14:44, Bill Allombert a écrit :

> On Sun, Mar 15, 2026 at 02:35:26PM +0100, Laël Cellier wrote:
> > Le 15/03/2026 à 14:07, Bill Allombert a écrit :
> >
> > > On Sun, Mar 15, 2026 at 01:49:37PM +0100, Laël Cellier wrote:
> > > > Bonjour,
> > > > in Sagemath, it s being exposed as _miller_() but what the Pari/gp
> > > > equivalent ? This would be for implementing the attachment below where the
> > > > Miller output is completely bilinear directly without divisions or final
> > > > exponentiation.
> > > You can simply use elltatepairing since it does not do the final exponentiation.
> > >
> > > Cheers,
> > > Bill.
> > Hi, but then this doesn’t seems to be tunable for the papers attached which
> > is a ate pairing (the case where no division or final exponentiation is
> > required after the Miller step)… Or am I getting it wrong ?
> The thig is, PARI elltatepairing actually computes the ate pairing.
>
> Cheers,
> Bill

Are you sure ? The scientific publication attached 
https://www.researchgate.net/profile/Florian-Hess-2/publication/221348700_Ate_Pairing_on_Hyperelliptic_Curves/links/0c96051dbc7c0a3178000000/Ate-Pairing-on-Hyperelliptic-Curves.pdf 
seems to describe a specific way to use the Miller algorithm in order to 
create their variant of the ate pairing…

Or at least I don’t understand the paper in the way that just selecting 
the right elliptic curve will lead to the ate pairing being bilinear 
without a coset.

Cordialement,