Elliptic Curves - The Weil Pairing II

The Weil Pairing II

There is an alternative way to define the Weil Pairing. To prove the equivalence of definitions, we first show that the pairing is nondegenerate and bilinear. Then this means the pairing is completely determined by its value on $e (P, Q)$ for some basis $P, Q$ of $E [m]$ , so in fact all bilinear nondegenerate pairings on $E [m]$ are equal up to a constant.

Let $P, Q$ be two $m$ -torsion points. Let $𝒜_{P}$ be some divisor such that

𝒜_{P} ~ ⟨ P ⟩ - ⟨ O ⟩

and similarly $𝒜_{Q}$ be a divisor such that

𝒜_{Q} ~ ⟨ Q ⟩ - ⟨ O ⟩

Both $m 𝒜_{P}$ and $m 𝒜_{Q}$ are principal. Let $f_{P}$ be a rational function such that

⟨ f_{P} ⟩ = m 𝒜_{P}

and similarly let $f_{Q}$ be a rational function such that

⟨ f_{Q} ⟩ = m 𝒜_{Q}

Then define the Weil pairing of $P$ and $Q$ to be

e (P, Q) = \frac{f_{P} (𝒜_{Q})}{f_{Q} (𝒜_{P})}

for choices of $f_{P}$ and $f_{Q}$ such that this ratio is well-defined.

Weil Reciprocity

To prove that the Weil pairing is well-defined and bilinear one uses a fact known as Weil reciprocity: for all rational functions $f, g$

f (⟨ g ⟩) = g (⟨ f ⟩)

The following gives some intuition as to why this may be true. Consider two functions $f (x) = (x - a_{1}) (x - a_{2})$ and $g (x) = (x - b_{1}) (x - b_{2})$ . Then the zeroes of $f$ are $a_{1}, a_{2}$ and the zeroes of $g$ are $b_{1}, b_{2}$ , and we have $f (b_{1}) f (b_{2}) = g (a_{1}) g (a_{2})$ .