Look in section 6 of my article "The Weil Pairing and its efficient calculation" http://tcs.uj.edu.pl/~mistar/pdf/Miller2004WeilPairing.pdf ([Wayback Machine](https://web.archive.org/web/20150913113350/https://michalstaromiejski.staff.tcs.uj.edu.pl/pdf/Miller2004WeilPairing.pdf))<sup>1</sup>.  It has the details that you want (much along the lines of Robin Chapman's answer).

<sup>1</sup><cite authors="Miller, Victor S.">_Miller, Victor S._, [**The Weil pairing, and its efficient calculation**](https://doi.org/10.1007/s00145-004-0315-8), J. Cryptology 17, No. 4, 235-261 (2004). [ZBL1078.14043](https://zbmath.org/?q=an:1078.14043).</cite>