0
$\begingroup$

I'm sorry if this question is not good for mathoverflow. In this article

http://www.staff.uni-oldenburg.de/florian.hess/publications/pairing-lattice.pdf

Florian Hess defined $a_{s,h}$ and $a_{s,h}^{twist}$ pairing (pages 5, 6).

He wrote that $a_{s,h}^{twist}$ define bilinear pairing if $k |$ #$Aut(E)$.

But if $k' = (k, $#$Aut(E)) > 0$ We can always replace $q$ -> $q^{k/k'}$ and k -> k' and take the same pairing that will be bilinear by theorem 1.

So we take that if $(k,$ #$Aut(E)) > 0 $

$a_{s,h}^{twist}$ define bilinear pairing.

Is it criteria for bilinear?

Is it possible that $a_{s,h}^{twist}$ define bilinear pairing for any $k$?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
1
$\begingroup$

In pairing based cryptography we like to have as large k as possible. Replacing q by q' = q^{k/k'} and treating the curve as embedding degree k' < k is not interesting. For general elliptic curves (i.e., not pairing-friendly) k' is exponentially large and so the new q' is exponentially large compared with k.

Improve this answer
$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .