Weil pairing

Choose an elliptic curve E defined over a field K, and an integer n > 0 (we require n to be coprime to char(K) if char(K) > 0) such that K contains a primitive nth root of unity. Then the n-torsion on ${\displaystyle E({\overline {K}})}$ is known to be a Cartesian product of two cyclic groups of order n. The Weil pairing produces an n-th root of unity

${\displaystyle w(P,Q)\in \mu _{n}}$

by means of Kummer theory, for any two points ${\displaystyle P,Q\in E(K)[n]}$, where ${\displaystyle E(K)[n]=\{T\in E(K)\mid n\cdot T=O\}}$ and ${\displaystyle \mu _{n}=\{x\in K\mid x^{n}=1\}}$.

A down-to-earth construction of the Weil pairing is as follows. Choose a function F in the function field of E over the algebraic closure of K with divisor

${\displaystyle \mathrm {div} (F)=\sum _{0\leq k<n}[P+k\cdot Q]-\sum _{0\leq k<n}[k\cdot Q].}$

So F has a simple zero at each point P + kQ, and a simple pole at each point kQ if these points are all distinct. Then F is well-defined up to multiplication by a constant. If G is the translation of F by Q, then by construction G has the same divisor, so the function G/F is constant.

Therefore if we define

${\displaystyle w(P,Q):={\frac {G}{F}}}$

we shall have an n-th root of unity (as translating n times must give 1) other than 1. With this definition it can be shown that w is alternating and bilinear,[1] giving rise to a non-degenerate pairing on the n-torsion.

The Weil pairing does not extend to a pairing on all the torsion points (the direct limit of n-torsion points) because the pairings for different n are not the same. However they do fit together to give a pairing T_ℓ(E) × T_ℓ(E) → T_ℓ(μ) on the Tate module T_ℓ(E) of the elliptic curve E (the inverse limit of the ℓⁿ-torsion points) to the Tate module T_ℓ(μ) of the multiplicative group (the inverse limit of ℓⁿ roots of unity).

For abelian varieties over an algebraically closed field K, the Weil pairing is a nondegenerate pairing

${\displaystyle A[n]\times A^{\vee }[n]\longrightarrow \mu _{n}}$

for all n prime to the characteristic of K.[2] Here ${\displaystyle A^{\vee }}$ denotes the dual abelian variety of A. This is the so-called Weil pairing for higher dimensions. If A is equipped with a polarisation

${\displaystyle \lambda :A\longrightarrow A^{\vee }}$,

then composition gives a (possibly degenerate) pairing

${\displaystyle A[n]\times A[n]\longrightarrow \mu _{n}.}$

If C is a projective, nonsingular curve of genus ≥ 0 over k, and J its Jacobian, then the theta-divisor of J induces a principal polarisation of J, which in this particular case happens to be an isomorphism (see autoduality of Jacobians). Hence, composing the Weil pairing for J with the polarisation gives a nondegenerate pairing

${\displaystyle J[n]\times J[n]\longrightarrow \mu _{n}}$

for all n prime to the characteristic of k.

As in the case of elliptic curves, explicit formulae for this pairing can be given in terms of divisors of C.

The pairing is used in number theory and algebraic geometry, and has also been applied in elliptic curve cryptography and identity based encryption.

• Tate pairing
• Pairing-based cryptography
• Boneh–Franklin scheme
• Homomorphic Signatures for Network Coding

• Weil, André (1940), "Sur les fonctions algébriques à corps de constantes fini", Les Comptes rendus de l'Académie des sciences, 210: 592–594, MR 0002863

• The Weil pairing on elliptic curves over C (PDF)