Re: Reduced Tate pairing in supersingular elliptic curves

[Aleksandr Lenin <aleksandr.lenin@cyber.ee>]

Hello Bill,

thanks for your answer.

On 04/18/2018 12:10 AM, Bill Allombert wrote:
> However E(F_q) is isomorphic to (Z/lZ)^2 with r^6 dividing l,
> and p2 is of order r, so p2 can be written as [r].q for some point q,
> so the Tate pairing (p1,p2) is trivial.

I do not completely understand the last inference about the triviality
of the Tate pairing.

In my current understanding of elliptic curve math, p1 and p2 may have
the same order r, or, in other words, belong to the r-torsion. In this
case, the reduced Tate pairing is trivial iff both points belong to the
same torsion subgroup (i.e., the base-field subgroup), and in all the
rest of possible cases, the pairing should be non-trivial.

In my example, point p1 coefficients are defined over the prime field
F_l, so in an elliptic curve defined over F_q, where q = l^2, p1 is
defined over the base-field subgroup of the r-torsion. Point p2 has both
coefficients being F_q elements (a*x,b), and thus belongs to the
r-torsion indeed, but it does not belong to the base-field subgroup as
p1 does, it belongs to some other subgroup (depending on the distortion
map used to generate p2).

If p1 and p2 belong to different subgroups of the r-torsion, shouldn't
it be the sufficient condition for non-triviality of the the reduced
Tate pairing?

-- 
Aleksandr