# Pairing

{{#invoke:Hatnote|hatnote}} The concept of pairing treated here occurs in mathematics.

## Definition

Let R be a commutative ring with unity, and let M, N and L be three R-modules.

A pairing is any R-bilinear map ${\displaystyle e:M\times N\to L}$. That is, it satisfies

${\displaystyle e(rm,n)=e(m,rn)=re(m,n)}$,
${\displaystyle e(m_{1}+m_{2},n)=e(m_{1},n)+e(m_{2},n)}$ and ${\displaystyle e(m,n_{1}+n_{2})=e(m,n_{1})+e(m,n_{2})}$

for any ${\displaystyle r\in R}$ and any ${\displaystyle m,m_{1},m_{2}\in M}$ and any ${\displaystyle n,n_{1},n_{2}\in N}$. Or equivalently, a pairing is an R-linear map

${\displaystyle M\otimes _{R}N\to L}$

where ${\displaystyle M\otimes _{R}N}$ denotes the tensor product of M and N.

A pairing can also be considered as an R-linear map ${\displaystyle \Phi :M\to \operatorname {Hom} _{R}(N,L)}$, which matches the first definition by setting ${\displaystyle \Phi (m)(n):=e(m,n)}$.

A pairing is called perfect if the above map ${\displaystyle \Phi }$ is an isomorphism of R-modules.

If ${\displaystyle N=M}$ a pairing is called alternating if for the above map we have ${\displaystyle e(m,m)=0}$.

A pairing is called non-degenerate if for the above map we have that ${\displaystyle e(m,n)=0}$ for all ${\displaystyle m}$ implies ${\displaystyle n=0}$.

## Examples

Any scalar product on a real vector space V is a pairing (set M = N = V, R = R in the above definitions).

The determinant map (2 × 2 matrices over k) → k can be seen as a pairing ${\displaystyle k^{2}\times k^{2}\to k}$.

The Hopf map ${\displaystyle S^{3}\to S^{2}}$ written as ${\displaystyle h:S^{2}\times S^{2}\to S^{2}}$ is an example of a pairing. In [1] for instance, Hardie et al. present an explicit construction of the map using poset models.

## Pairings in cryptography

{{#invoke:main|main}} In cryptography, often the following specialized definition is used:[2]

for which the following holds:

Note that is also common in cryptographic literature for all groups to be written in multiplicative notation.

In cases when ${\displaystyle \textstyle G_{1}=G_{2}=G}$, the pairing is called symmetric. If, furthermore, ${\displaystyle \textstyle G}$ is cyclic, the map ${\displaystyle e}$ will be commutative; that is, for any ${\displaystyle P,Q\in G}$, we have ${\displaystyle e(P,Q)=e(Q,P)}$. This is because for a generator ${\displaystyle g\in G}$, there exist integers ${\displaystyle p}$, ${\displaystyle q}$ such that ${\displaystyle P=g^{p}}$ and ${\displaystyle Q=g^{q}}$. Therefore ${\displaystyle e(P,Q)=e(g^{p},g^{q})=e(g,g)^{pq}=e(g^{q},g^{p})=e(Q,P)}$.

The Weil pairing is an important pairing in elliptic curve cryptography; e.g., it may be used to attack certain elliptic curves (see MOV attack). It and other pairings have been used to develop identity-based encryption schemes.

## Slightly different usages of the notion of pairing

Scalar products on complex vector spaces are sometimes called pairings, although they are not bilinear. For example, in representation theory, one has a scalar product on the characters of complex representations of a finite group which is frequently called character pairing.

## References

1. A nontrivial pairing of finite T0 spaces Authors: Hardie K.A.1; Vermeulen J.J.C.; Witbooi P.J. Source: Topology and its Applications, Volume 125, Number 3, 20 November 2002 , pp. 533-542(10)
2. Dan Boneh, Matthew K. Franklin, Identity-Based Encryption from the Weil Pairing Advances in Cryptology - Proceedings of CRYPTO 2001 (2001)