Unimplemented. The supersingular curves y^{2} = x^{3} + 2x + 1 and
y^{2} = x^{3} + 2x - 1 over a field of characteristic 3. Discussed at length
by Boneh, Lynn, and Shacham, "Short signatures from the Weil pairing".
Many optimizations can be applied to speed up these pairings; see
Barreto et al., "Efficient algorithms for pairing-based cryptosystems", but
sadly, an attack due to Coppersmith makes these curves less attractive.