Posts  / #POST-001372
REDDIT

I was explained how to know if a given qth root can be used for elliptic curve pairing inversion. But what he did mean ?

A
Feb 13, 2025 · 05:38

There are many research papers that propose to lower the problem of fixed pairing inversion to exponentiation inversion. I asked a busy researcher how to determine if a value before exponentiation is suitable for Miller/pairing inversion and here’s his answer

> Suppose the elliptic curve is defined over F_p,
the embedding degree k is even, and the order of pairing is a prime r.
Put m:=k/2.
You must obtain the collect value of h_{p^m+1,A}(Q)
(where both A and Q are of order r).
But h_{r,A}(Q) have only to be precise up to (p^m+1)/r th root of the unity.
That is, instead of the correct value z, the value zu where
u^{(p^m+1)/r}=1 will do. This is because u is eliminated in the process
to obtain h_{p^m+1,A}(Q) from h_{r,A}(Q).

I know what’s an elliptic curve billinear pairing. I know what’s the order and the embedding degree of an elliptic curve, but I understood nothing else from his answer.