-to-Point. Map-to-Point is an algorithm for converting an arbitrary bit string into an elliptic curve point. Firstly, the string has to be converted into an integer and then a mapping is required from that integer onto an elliptic curve point. There are fast algorithms for computation of scalar multiplication of point and map- to-point operation [15]. 2.2 Bilinear pairings A bilinear pairing is a function that takes as input two groups and outputs an element of a multiplicative group [6, 19]. The Weil pairing and the Tate pairing are the two most commonly used bilinear

http://arxiv.org/abs/1409.0846 [11] E. Fouvry and H. Iwaniec, Gaussian primes, Acta Arith. 79 (1997), no. 3, 249–287. 10.4064/aa-79-3-249-287 Fouvry E. Iwaniec H. Gaussian primes Acta Arith. 79 1997 3 249 287 [12] G. Frey, M. Müller and H.-G. Rück, The Tate pairing and the discrete logarithm applied to elliptic curve cryptosystems, IEEE Trans. Inform. Theory 45 (1999), no. 5, 1717–1719. 10.1109/18.771254 Frey G. Müller M. Rück H.-G. The Tate pairing and the discrete logarithm applied to elliptic curve cryptosystems IEEE Trans. Inform. Theory 45 1999 5 1717

- vanishing of LK.E; ; 1/. On the other hand, .ŒLK.E; ; 1// 6D 0 by (8.3) and p− t` because ` is admissible, hence claim (8.6) follows from Theorem 7.4. Longo, Rotger and Vigni, Special values of L-functions and Darmon points 239 8.4. Local Tate pairings and global duality. For every place v of Q, including the archimedean one, denote by h ; iv W H 1.Hc;v; EŒp/ H 1.Hc;v; EŒp/ ! Z=pZ the local Tate pairing at v. Global Tate duality, which is a consequence of the reciprocity law of class field theory (specifically, of the global reciprocity law for elements in the Brauer

pairing a very costly object to compute [ 18 , 22 ]. Freeman provides sample parameter sizes of bilinear groups for various security levels [ 18 , Section 4] and mentions that for 80-bit security level a composite order Tate pairing on a 1024-bit supersingular curve would be approximately 50 times slower than a prime order Tate pairing on a 170-bit MNT curve. In [ 22 ] it was reported that a composite order pairing for 128-bit security level was approximately 254 times slower than its prime order counterpart for the same security level. This efficiency bottleneck

curves as proposed by Brezing and Weng [6]. We use the notation N, Z, Q for the set of positive integers, rational integers and rational numbers, respectively. We denote by Fq a finite field with order q. The order of an elliptic curve E over Fq is given by #E.Fq/ D q C 1 t; where t 2 Z is the trace of the Frobenius map. Pairing-based cryptographic systems require a non-degenerate pairing which can be efficiently computed. For example, the most common pairings used in 252 K. Okano applications are Weil and Tate pairings. We define the embedding degree with respect to

$symmetric orientation of the biden- tate pair to the metal ions. In many multidentate ligands such binding presents steric requirements that are frequentlydifficult to meet, as discussed below. In addition to well known combinations of amino and carboxylate groups, special attention will be given to phosphonate, phenolate, hydroxamate, catecholate and peptide donors. POLYAMINOPOLYCARBOXYLATES Table 3 presents representative data that are currently available (Ref. 4) on the stabilities of metal chelates of a series of ligands that constitute a linear extension of the NTA and

Selmer n-coverings (see [6], Theorem B.3.2). Thus explicit n-descent enables us to find generators for the Mor- dell-Weil group more easily, and hence sometimes to show that the n-torsion of the Tate- Shafarevich group is trivial. Secondly, if we have already computed the Mordell-Weil group, for instance using descent at some other n 0, then we can use explicit n-descent to exhibit concrete examples of non-trivial n-torsion elements of [ðK;EÞ. Our work is also likely to form a useful starting point for performing higher descents, and for computing the Cassels-Tate

{h}_{p}^{\mathrm{ac}}} . Definition 3.27. Define the Λ ac 𝔬 {\Lambda_{\mathrm{ac}}^{\mathfrak{o}}} -adic Tate pairing 〈 ⋅ , ⋅ 〉 Tate : H + / f 1 ( K p , 𝕋 f , α ac ) ⊗ H ℱ Gr 1 ( K 𝔭 c , 𝕋 f , α - 1 ac ) → ∼ Λ ac 𝔬 \langle\,\cdot\,,\cdot\,\rangle_{\mathrm{Tate}}:H^{1}_{+/\mathrm{f}}(K_{p},% \mathbb{T}^{\mathrm{ac}}_{f,\alpha})\otimes H^{1}_{\mathcal{F}_{\mathrm{Gr}}}(% K_{\mathfrak{p}^{c}},\mathbb{T}_{f,\alpha^{-1}}^{\mathrm{ac}})\xrightarrow{% \sim}\Lambda_{\mathrm{ac}}^{\mathfrak{o}} by setting 〈 𝔞 , 𝔟 〉 Tate := lim ← ∑ γ ∈ Γ n ac 〈 π n ( 𝔞 ) γ , π n ( 𝔟 ) 〉 n ⋅ γ - 1

-based cryptography and its security analysis 47 4.1 Pairing In this paper we deal with Tate pairing using the supersingular curves over finite fields of characteristic three, which have been used for efficient implementation of pairing [4, 15, 24]. Let GF.3n/ be the finite field of characteristic three and extension degree n. For b D ˙1 the supersingular elliptic curve Eb3 .n/ over GF.3n/ is defined by Eb3 .n/ D ¹.x; y/ 2 GF.3n/ GF.3n/ jy2 D x3 x C bº [ ¹1º: We usually choose n as a prime number in cryptography. The order of Eb3 .n/ is #Eb3 .n/ D 3n C 1C b 3 n 3.nC1/=2; where

Cassels–Tate pairing induces a canonical isomorphism between Ш p ( A F ) ∨ ${\Sha_{p}(A_{F})^{\vee}}$ and Ш p ( A F t ) ${\Sha_{p}(A^{t}_{F})}$ , we immediately obtain the following corollary: Corollary 2.14 Under the assumptions of Theorem 2.12 one has that the element L # ${\mathcal{L}^{\#}}$ of I G , p h ${I_{G,p}^{h}}$ annihilates the Z p [ G ] ${\mathbb{Z}_{p}[G]}$ -module Ш p ( A F ) ${\Sha_{p}(A_{F})}$ . 3 An explicit reformulation of conjecture C p ( A , ℤ [ G ] ) ${\mathrm{C}_{p}(A,\mathbb{Z}[G])}$ 3.1 K-theory and refined Euler