Recent progress on pairing implementation has made certain pairings extremely simple
and fast to compute. Hence, it is natural to examine if there are consequences for the security of
This paper gives a method to compute eta pairings on certain supersingular curves with a greatly
simplified final exponentiation. The method does not lead to any improvement in the speed of pairing
implementation. However, we show that it leads to a multivariate attack on the pairing inversion
problem. We analyse this attack and show that it is infeasible for elliptic curves.