Type A pairings are constructed on the curve y² = x³ \+ x over the field F_q for some prime q. Both G1 and G2 are the group of points E(F_q), so this pairing is symmetric. It turns out #E(F_q) = q \+ 1 and #E(F_q²) = (q \+ 1)². Thus the embedding degree k is 2, and hence GT is a subgroup of F_q^2. The order r is some prime factor of q \+ 1.

Write q \+ 1 = r * h. For efficiency, r is picked to be a Solinas prime, that is, r has the form 2^a +- 2^b +- 1 for some integers 0 < b < a.

Also, q = -1 mod 12 so F_q² can be implemented as F_q[i] (where i = sqrt(-1)) and since q = -1 mod 3, cube roots in F_q are easy to compute. This latter feature may be removed because I have not found a use for it yet (in which case we only need q = -1 mod 4).

a_param struct fields:

exp2, exp1, sign1, sign0, r:
  r = 2^exp2 + sign1 * 2^exp1 + sign0 * 1 (Solinas prime)
q, h:
  r * h = q + 1
  q is a prime, h is a multiple of 12 (thus q = -1 mod 12)