Bilinear pairings on elliptic curves

TL;DR

This paper provides a comprehensive, elementary introduction to elliptic curve pairings, clarifies their definitions, and discusses various efficient pairing types and their cryptographic applications.

Contribution

It offers the first correct and self-contained presentation of the three Weil pairing definitions and introduces shorter, efficient pairings with proofs of their properties.

Findings

Correct and unified presentation of Weil pairings

Introduction of shorter, efficient pairings like ate and R-ate

Review of pairings in cryptographic applications

Abstract

We give an elementary and self-contained introduction to pairings on elliptic curves over finite fields. For the first time in the literature, the three different definitions of the Weil pairing are stated correctly and proved to be equivalent using Weil reciprocity. Pairings with shorter loops, such as the ate, ate$_i$, R-ate and optimal pairings, together with their twisted variants, are presented with proofs of their bilinearity and non-degeneracy. Finally, we review different types of pairings in a cryptographic context. This article can be seen as an update chapter to A. Enge, Elliptic Curves and Their Applications to Cryptography - An Introduction, Kluwer Academic Publishers 1999.