Omega Pairing on Hyperelliptic Curves

Abstract

The omega pairing is proposed as a variant of Weil pairing on special elliptic curves using automorphisms. In this paper, we generalize the omega pairing to general hyperelliptic curves and use the pairing lattice to construct the optimal omega pairing which has short Miller loop length and simple final exponentiation. On some special hyperelliptic curves, the optimal omega pairing could be super-optimal.

A Explicit Proofs

Proof of Lemma 1: We denote $D_l=\varepsilon (D_{l})-m_l(P_\infty )$ for $l=1, 2$ and $[k] D_l=\varepsilon ([k]D_{l})-m_{lk}(P_\infty )$ for $k=i, j.$ Let $u_\infty$ be a $\mathbb {F}_{q}$-rational uniformizer for $P_\infty$ and assume $supp(div(u_\infty ))\cap supp(\varepsilon (D_{1}))=\emptyset$. Thus

$$ supp(div(f_{i,D_1}))\cap supp((jm_2-m_{2j})(P_\infty )+div(\frac{1}{{u_\infty }^{(jm_2-m_{2j})}}))=\emptyset . $$

Since $f_{i,D_1}$ is a $\mathbb {F}_{q}$-rational function, so

$$ \left( f_{i,D_1}((jm_2-m_{2j})(P_\infty )+div(\frac{1}{{u_\infty }^{(jm_2-m_{2j})}}))\right) ^{q-1}=1 $$

by Fermat’s Little Theorem. According to Weil reciprocity [23] , we have

$$ \begin{array}{ll} &{}\left( f_{i,D_{1}}(\varepsilon ([j]D_{2}))f_{i,D_{1}}^{-j}(\varepsilon (D_{2}))\right) ^{q-1}\\ &{}=\left( f_{i,D_{1}}(\varepsilon ([j]D_{2})-j\varepsilon (D_{2})+(jm_2-m_{2j})(P_\infty )+div(\frac{1}{{u_\infty }^{(jm_2-m_{2j})}}))\right) ^{q-1}\\ &{}= \left( f_{i,D_{1}}([j]D_{2}-jD_{2}+div(\frac{1}{{u_\infty }^{(jm_2-m_{2j})}}))\right) ^{q-1} \\ &{}= \left( f_{i,D_{1}}(div((f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})})^{-1}))\right) ^{q-1}\\ &{}= \left( (f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})})^{-1}(div(f_{i,D_{1}}))\right) ^{q-1}\\ &{}=\left( {f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})}}([i]D_1-iD_1)\right) ^{q-1}\\ &{}=\left( f_{j,D_{2}}(\varepsilon ([i]D_{1})-i\varepsilon (D_{1}))\right) ^{q-1} \left( { u_\infty }^{(jm_2-m_{2j})}(\varepsilon ([i]D_{1})-i\varepsilon (D_{1}))\right) ^{q-1}\\ &{}\cdot \left( {f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})}}((im_1-m_{1i})(P_\infty ))\right) ^{q-1}\\ &{}= \left( f_{j,D_{2}}(\varepsilon ([i]D_{1}))f_{j,D_{2}}^{-i}(\varepsilon (D_{1}))\right) ^{q-1}. \end{array} $$

In fact, $u_\infty$ and reduced divisor $D_1$ are $\mathbb {F}_{q}$-rational, so

$$ \left( { u_\infty }^{(jm_2-m_{2j})}(\varepsilon ([i]D_{1})-i\varepsilon (D_{1}))\right) ^{q-1}=1. $$

On the other hand, $ord_{P_\infty }({f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})}})=0$ shows that this function is defined on $P_\infty$. Then ${f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})}}$ is normalised implies that

$$\begin{aligned} {f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})}}(P_\infty )=lc_\infty ({f_{j,D_{2}}{u_\infty }^{(jm_2-m_{2j})}})=1. \end{aligned}$$

(2)

So the last indentity holds and it is followed by the equation

$$ \left( \frac{f_{i,D_{1}}(\varepsilon ([j]D_{2}))}{f_{j,D_{2}}(\varepsilon ([i]D_{1}))}\right) ^{q-1}= \left( \frac{f_{i,D_{1}}^j(\varepsilon (D_{2}))}{f_{j,D_{2}}^i(\varepsilon (D_{1}))}\right) ^{q-1} . $$

      $\square$

Proof of Lemma 2: Let $\phi$ be the $\mathbb {F}_{q}$-rational automorphism defined in Theorem 1, then $[\lambda ]D_1=\phi (D_1)$. Since the automorphism is also an isogeny, so we can denote its daul isogeny as $\widehat{\phi }$, where $\phi \circ \widehat{\phi }=[1]$ and $\widehat{\phi }$ is also $\mathbb {F}_{q}$-rational. Thus $[\lambda ]D_2=\widehat{\phi }(D_1)$. According to Lemma $3$ in [11], we have $f_{\lambda ,[\lambda ]D_{1}}=\alpha f_{\lambda ,D_{1}}\circ \widehat{\phi }$ with $\alpha \in \mathbb {F}_{q}$. By mathematical induction, the identity can be obtained. Following Lemma 1, let $i=j=\lambda$, we have

$$ \left( \frac{f_{\lambda ,D_{1}}(\varepsilon ([\lambda ]D_{2}))}{f_{\lambda ,D_{2}} (\varepsilon ([\lambda ]D_{1}))}\right) ^{q-1}= \left( \frac{f_{\lambda ,D_{1}}(\varepsilon (D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon (D_{1}))}\right) ^{\lambda (q-1)}. $$

Suppose the identity in Lemma 2 holds for $i$, we can prove it also holds for $i+1$. In fact,

$$ \begin{array}{ll} \left( \frac{f_{\lambda ,D_{1}}(\varepsilon ([\lambda ^{i+1}]D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon ([\lambda ^{i+1}]D_{1}))}\right) ^{q-1} &{}=\left( \frac{f_{\lambda ,D_{1}}(\varepsilon (\widehat{\phi }^i([\lambda ]D_{2})))}{f_{\lambda ,D_{2}}(\varepsilon ([\lambda ][\lambda ^{i}]D_{1}))}\right) ^{q-1}\\ &{}=\left( \frac{f_{\lambda ,D_{1}}(\widehat{\phi }^i(\varepsilon ([\lambda ]D_{2})))}{f_{\lambda ,D_{2}}(\varepsilon ([\lambda ][\lambda ^{i}]D_{1}))}\right) ^{q-1}\\ &{}=\left( \frac{f_{\lambda ,[\lambda ^i]D_{1}}(\varepsilon ([\lambda ]D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon ([\lambda ][\lambda ^{i}]D_{1}))}\right) ^{q-1}\\ &{}=\left( \frac{f_{\lambda ,[\lambda ^i]D_{1}}(\varepsilon (D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon ([\lambda ^{i}]D_{1}))}\right) ^{\lambda (q-1)}\\ &{}=\left( \frac{f_{\lambda ,D_{1}}(\varepsilon ([\lambda ^{i}]D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon ([\lambda ^{i}]D_{1}))}\right) ^{\lambda (q-1)}\\ &{}=\left( \frac{f_{\lambda ,D_{1}}(\varepsilon (D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon (D_{1}))}\right) ^{\lambda ^{i+1}(q-1)}. \end{array} $$

The mathematical induction gives the result of this lemma.       $\square$

Proof of Lemma 3: To prove the result, it suffices to show that $\left( \left( \frac{f_{\lambda ,D_{1}}(\varepsilon (D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon (D_{1}))}\right) ^{q-1}\right) ^r=1.$ As is stated in Lemma 1, $u_\infty$ is a $\mathbb {F}_{q}$-rational uniformizer for $P_\infty$. For the similar reasons with Equation (2),

$$ {f_{\lambda ,D_{2}}{u_\infty }^{((\lambda -1)m_{2})}}(P_\infty )={f_{r,D_{2}}{u_\infty }^{rm_{2}}}(P_\infty )=1. $$

Assume $div(u_\infty )=P_\infty +D_\infty$ and $supp(D_\infty ) \cap supp(div(f_{r,D_1}))=\emptyset$. According to Weil reciprocity [23] and Fermat’s Little Theorem, we have

$$ \begin{array}{ll} \left( \frac{f_{\lambda ,D_{1}}(\varepsilon (D_{2}))}{f_{\lambda ,D_{2}}(\varepsilon (D_{1}))}\right) ^{(q-1)r}\\ =\left( \frac{f_{\lambda ,D_{1}}(\varepsilon (D_{2})-m_2(P_\infty )+div(u_\infty ^{m_2}))}{f_{\lambda ,D_{2}}{u_\infty }^{(\lambda -1)m_{2}} (\varepsilon (D_{1})-m_1(P_\infty ))}\right) ^{(q-1)r}\\ =\left( \frac{f_{\lambda ,D_{1}}(r D_{2}+div(u_\infty ^{rm_2}))}{f_{\lambda ,D_{2}}{u_\infty }^{(\lambda -1)m_{2}}(r D_{1})}\right) ^{(q-1)r}\\ =\left( \frac{{f_{r,D_{2}}{u_\infty }^{rm_{2}}}(\lambda D_1-[\lambda ]D_1)}{f_{r,D_{1}}(\lambda D_2-[\lambda ]D_2+div(u_\infty ^{(\lambda -1)m_2}))}\right) ^{q-1}\\ =\left( \frac{{f_{r,D_{2}}(\lambda \varepsilon (D_{1})-\varepsilon ([\lambda ]D_{1})){u_\infty }^{rm_{2}}}(\lambda \varepsilon (D_{1})-\varepsilon ([\lambda ]D_{1})){f_{r,D_{2}}{u_\infty }^{rm_{2}}}(-(\lambda -1)m_1(P_\infty ))}{f_{r,D_{1}}(\lambda \varepsilon (D_{1})-\varepsilon ([\lambda ]D_{1}))f_{r,D_{1}}(D_\infty )}\right) ^{q-1}\\ =\left( \frac{f_{r,D_{2}}(\lambda \varepsilon (D_{1}))}{f_{r,D_{1}}(\lambda \varepsilon (D_{2}))} \frac{f_{r,D_{1}}(\varepsilon ([\lambda ]D_{2}))}{f_{r,D_{2}}(\varepsilon ([\lambda ]D_{1}))}\right) ^{q-1}\\ =\left( \frac{f_{r,D_{2}}( \varepsilon (D_{1}))}{f_{r,D_{1}}( \varepsilon (D_{2}))}\right) ^\lambda \left( \frac{f_{r,[\lambda ]D_{1}}(\varepsilon (D_{2}))}{f_{r,D_{2}}(\varepsilon ([\lambda ]D_{1}))}\right) ^{q-1}\\ =\left( (-1)^{rm_1m_2}e_r(D_{1},D_{2})^\lambda (-1)^{rm_1m_2}e_r(D_{2},[\lambda ]D_{1})\right) ^{q-1}\\ =\left( e_r(D_{1},D_{2})^\lambda e_r(D_{2},D_{1})^\lambda \right) ^{q-1}\\ =1 \end{array} $$

This complete the proof of Lemma 3.

      $\square$