Re: Problem: the Tate pairing function does not preserve bilinearity properties

[Bill Allombert <Bill.Allombert@math.u-bordeaux.fr>]

On Fri, Mar 02, 2018 at 02:22:26PM +0200, Aleksandr Lenin wrote:
> Hi all,
> 
> I've stumbled across the following problem and need an advice - am I
> missing something here, or did I understand something wrong?
> 
> [Problem description]
> 
> Consider a supersingular elliptic curve y^3 = x^2 + 1 defined over an
> extension field F_{59^2}. Consider two points P and Q belonging to to
> different subgroups of the 5-torsion.
> 
> P = (28,51) is the point residing in the base field subgroup
> Q = (23*x+45,51) is the point obtained by applying the distortion map to P.
> 
> I am checking for bilinearity property: e([2]P,Q) = e(P,Q)^2

Hello Aleksandr,

This is not true for the non-reduced Tate pairing returned by PARI.
This formula holds only modulo the 5-powers:

a=ffgen((a^2+1)*Mod(1,59));
E=ellinit([0,1],a);
P=[28,51];DP=[18,13];Q=[23*a+45,51];
? l=(59^2-1)/5
elltatepairing(E,P,Q,5)^2/elltatepairing(E,DP,Q,5)
%26 = 8*a
? (elltatepairing(E,P,Q,5)^2/elltatepairing(E,DP,Q,5))^l
%28 = 1

Sage returns the reduced Tate pairing instead,
which is elltatepairing(E,P,Q,5)^l

One good reference is
https://hal.inria.fr/hal-00767404v2/document

Cheers,
Bill.