.6, states that if the abelian variety AF has semistable ordinary reduction at all the primes of F above p then the p-adic height pairing on AF defined using the unit-root splitting and the one of Mazur-Tate coincide. Let us now describe the idea of the proof. p-adic height pairings are the Qp-valued counterparts of the real-valued Néron-Tate height pairings on abelian varieties. As the Néron-Tate pairings they can be decomposed into local contributions, one for each finite place of the ground field F . At the places not dividing p, these local contributions are

for each n > 0. Let r be a prime dividing #Jac(C)(Fq) and coprime to p. We define the embedding degree to be the smallest positive integer k such that r divides qk − 1; note that Fqk is the field generated over Fq by adjoining the group µr of rth roots of unity in Fq. Throughout, er : Jac(C)[r]× Jac(C)[r]→ µr ⊂ F∗qk denotes a non-degenerate, bilinear, and Galois-invariant pairing on Jac(C)[r], such as the Weil pairing or the reduced Tate pairing; we refer the reader to [1, 2, 8, 7, 16, 17] for details on pairings and pairing-based cryptography. An elliptic curve E

the Cassels–Tate pairing equals that of the Artin–Verdier pairing ½a2; b 0, where b 0 A H 1 U ;TZ=nZðM Þ is a preimage of a 0. A diagram chasing now shows that a2 comes from ðcvÞ A L v AS H 1 kv;TZ=nZðMÞ . It follows that ½a2; b 0 equals the sum of the local pairings hcv; b 0viv for v A S, where b 0 v is the image of b 0 in H 1 kv;TZ=nZðM Þ . Our assumption that ha; a 0i ¼ 0 for all a 0 A D1ðU ;M Þ½n thus implies that ðcvÞ satisfies the assumptions of the lemma, and hence up to modifying it by an element of L v AS H0ðkv;MÞ (which does not change a), we may

field in one variable over a finite field, provided that one ignores the p-primary torsion part of the groups under consideration, where p ¼ char k. We leave the verification of this to the readers. 6. Comparison with the Cassels-Tate pairing In this section, we give a definition of the pairing of Theorem 0.2 purely in terms of Galois cohomology and show that in the case M ¼ ½0! A it reduces to the classical Cassels-Tate pairing for abelian varieties. The idea is to use the diminished cup-product construction discovered by Poonen and Stoll (see [20], pp. 1117

H 1ðKw;TÞ=H 1FðKw;TÞ where the sum is over all places w of K . A Selmer structure F is self-dual if the submodule H 1FðKw;TÞ is maximal isotropic under the (symmetric) local Tate pairing H 1ðKw;TÞ H 1ðKw;TÞ ! W H 2 Kw;Rð1Þ GR for every finite place w A SF. Remark 2.1.2. Note that p3 2 implies H 1ðKw;TÞ ¼ 0 for w archimedean. By Tate local duality, H 1FðKw;TÞ ¼ H 1unrðKw;TÞ is maximal isotropic for all w B SF. Remark 2.1.3. If S is a submodule (resp. quotient) of T and ðF;SFÞ is a Selmer structure on T , then there is an induced Selmer structure, still denoted ðF

duality gives a perfect pairing H1ðFq;TÞ H1ðFq;W Þ ! F=O satisfying ðlx; yÞ ¼ x; iðlÞy for any l A LðFÞ. In order to make the Tate pairing LðFÞ- equivariant, we agree to view X ðFÞ as a LðFÞ-module via ðl f ÞðxÞ ¼ f iðlÞx and similarly for X ðFÞ, X SðFÞ, etc. Denote by Cy, Dy, and Ky the cyclotomic Zp-extension, the anticyclotomic Zp- extension, and the unique Z2p-extension of K, respectively. Set G ¼ GalðDy=KÞ, so GGZp. Thus we have a field diagram: Ky Cy Dy G K : We will often work with the Iwasawa algebras LðKyÞ and LðDyÞ, so it is convenient to define the ideal

–Rück attack and MOV attack use the Tate pairing and Weil pairing, respectively, to map the discrete logarithm problem on the curve’s Jaco- bian defined over Fq to the discrete logarithm in the multiplicative group of the exten- 20 Laura Hitt sion field Fqk , for some integer k, where there are more efficient methods for solving the DLP. This extension degree k is known as the embedding degree. We will say a curve C has embedding degree k with respect to an integer N if and only if a subgroup of order N of its Jacobian JC does. So for pairing-based cryptosystems, it is impor

perfect pairing of finite groups CA;F ;S C1B;F ;S ! Q=Z; where C1B;F ;S is the group (3.7) associated to B. 89González-Avil és, On Néron class groups of abelian varieties Proof. By the previous corollary and the existence of the perfect ‘‘Cassels–Tate pair- ing’’ [1ðAÞ [1ðBÞ ! Q=Z ([11], Corollary 4.9, and [8], Corollary 6.7), the dual of the second exact sequence appearing in Proposition 3.4 for B is an exact sequence 0! ðC1B;F ;SÞ D ! D1ðU ;AÞ ![1ðAÞ ! 0: The compatibility of the Cassels–Tate pairing with the pairings (4.3) and (4.4) for G ¼ 0 and G 0 ¼ F 0 (see

the local conditions F ¼Fcl or F ¼FL to be H 1Fðk;TÞ :¼ ker H 1ðk;TÞ ! Q l H 1ðkl;TÞ=H 1Fðkl;TÞ where the product runs over all rational primes l. 1.2. Local duality and Selmer groups for T*. We now define the dual Selmer struc- ture to ðT ;FLÞ and the dual Selmer group. Later in this section, we will compute the classical and the modified Selmer groups explicitly and compare their sizes to each other. Let T ¼ HomZpðT ;Qp=ZpÞð1ÞGQp=Zp n w be the Cartier dual of T . For any prime l of k, let h ; il denote the local Tate pairing h ; il : H 1ðkl;TÞ H 1ðkl;T Þ ! Qp

supersingular case, making its Pontryagin dual not pŒŒ€-torsion. The two modified Selmer groups each have a stronger local condition E]=[1 at p, which intuitively can be thought of as half-Q1;p-rational points of E: Sel]p.E=Q1/ WD ker H 1.Q1; EŒp 1/! H 1.Q1;p; EŒp 1/=E ] 1;p : In the above line, E]1;p is the exact annihilator with respect to the Tate pairing of the kernel of a map Col] W H 1.Q1;p; T /!p ŒŒ€. This Col] and its companion Col[ each encode half the information of the local points as they together know the geometry of E.Q1;p/˝Qp=p: They respect the