PSE Lectures Ep 34 - Constructing the Weil pairing

Transcript

okay so I want to start today with um reminding you a proof of that we went over but some time ago and and we we used it for the construction of the we pairing um so maybe it's it could help you feel more comfortable so the claim is um let e um be anip c um with a a k algebraically

closed this is um proposition 6 107 um and and suppose I have um a a rational map row which I remind you it's like two components of rational functions RNs um this goes from e of K to e of k a rational

M IE um for any point on the Curve um if I do so you know you can you can think of r as the the x coordinate and S is the y coordinate and then I I want that um if I if I do s of P Square it's equal to um R of P Cube plus a r of p plus

b right that that's that's what it means to be a rational MTH um then first if I take any of the the rational functions um both are well let me let me put it this way um for any rational

function know what I um then um I either row is um constant or it is subjective and the proof um it it's kind of I was wondering if I should do um the rational function case in the

statement but let's do it in the proof so um let's um um first show that any rational function uh um let's say R in K of e viewed is a function and R from E of

K to the projective line remind you this is K Union Infinity is either constant or subjective so um suppose R is non constant then I claim that R has to have a

zero then um the the div basically the divisor of R is not the zero divisor and and because we know that the only the only rational functions that have a zero divisor are constant constant functions um and if the divisor is non zero then since it's the it's a principal divisor it's a divisor of some rational function the this sum of I mean the the degree of the divisor has to be zero

which means that the the sum of the positive coefficients has to be the same as the sum of the negative coefficients so we have to have a zero and we have to have a poll um of some order in in R so R has a poll um for some x0 in k r minus x0 is is also non constant

hence also has a poll but what is a poll of r0 sorry of R minus x0 um i e there exists some p in e k such that um R of p is equal to x0 um but this means this means that R is rejected because we we picked x0 to be

an arbitrary element in the um in the field so we know that we cover um Infinity that's because R has to have a pole and we know that we cover every every element x0 in k um because because of the the other argument is this clear uh I'm a bit uh confused with that we say okay it is either constant or subjective uh but uh then we start um discussing that it's can it can't be

constant no we say suppose it is not I mean yeah if it is constant it's clearly not subjective I mean constant cannot be subjective um so let's assume it is not constant and show that in any case it is not constant it must be subjective oh I see I see okay that's it yes okay and now um let's go to the the the rational map case um so now um for a a row equals R Comm S as above

suppose r I want R where if R is constant then m s um can get I mean a s can can have then um at most two values can

get um at most and values because it has to be the solution I mean because for any p um s p squar has to be equal to rpq plus a a RP plus b and RP is constant I mean RP gets only one value so SP it can get either the the pl the square root of this uh thing so this

SP is equal to plus minus square root of this of this thing but s is a rational function it cannot get only two values I mean either it's constant or it is subjective constant means that it gets it it gets only one value so since it is I mean two values are definitely not cannot make it subjective then it means that s is also constant

hence um p is constant sorry not p so okay so now suppose R is not constant this means that R is rejective and now I want to make a an argument

showing that in this case s also must be subjective um and and then it would follow that raw is rejected so so how do I go about it I um [Music] um R has to have it's it's non- constant right so it has to have well it's subjective so it has to have a pole hence also a

zero it has a PO because it's rejective right it's it means that um some some point in e um evaluates to Infinity under r and now um so let P be such that m r of p is equal to

Infinity right that's that's some pole of R then because row is a rational function I know that s of P also has to be Infinity since raw is a rational mark remember this um this equation needs to be needs to be valid also for um the I mean for Infinity so if one side is

equal to Infinity the other side has to be also equal to infinity and then this this point is like a Infinity comma Infinity is like the the zero I mean the the the point at Infinity so um take um an arbitrary point on the Curve the

map to minus Q from e e of k e of K is rational right it's a translation by Q or sorry translation by minus key um hence the composition if I do first row and then translation by minus q and

and the composition um to minus qos row is um a rational Mar so in the the argument above I mean what we have

shown in the argument above is that there is some point um let me just write it here the conclusion of the argument above is that there is some point P such that row of p is equal to Infinity S is equal to O right because I I found some P such that R of p is equal to infinity and and then s of P must be equal to infinity and this means that raow evaluates to

Infinity on this point but this is true for any rational map in particular it's is true shows that there exist some point P such that to minus Q composed with raow evaluated at p is equal to O but this means that I mean what is a a a t to minus Q composed with row evaluated at P it

means that row of um and T and then minus Q isal to I and of p is equal so raow is rejected right I I I I chose an

arbitrary arbitrary Point Q okay and that's that's the end of the argument any questions about the proof what do you think now does it mean that um any any point on the elliptic Curve will be always mapped to Q um what is subjective subjective means that for any

point um I mean raw is a map from the the the K rational points to the K rational points and saying that Ro is surjective means that for any q that you choose here there exist some p such that um p is M to Q so Q is row of P so the quantification of the subjective means for any Q There exist P okay then uh when we constructed the proof uh

we I I I want to a bit like a reverse engineer how you came up uh that you wanted to take this composition of two functions to construct this proof well because I needed to show I mean basically I showed that um that zero so I mean o is in the in the image of any rational Mar right right and then I say I want to show that well of any um and then I say I want to show that any rational map that is not constant is subjective means that any Q any

arbitrary Q is also in the image so I say Okay so let's compose this let's take an arbitrary rational map compose it with translation by minus q and I know that this is again a rational map it has to I mean o is is in its image but if o is in its image then it means that um Q is in the image of Rong right this yes yes nice nice nice thank you and one question so here you use the translation with the negative Q so at the end you get a row of P equals q but if you swap the sign it like the the the

logic will still hold right yeah I could do translation by q but then I I would say then the conclusion would say that for any Q There is a p such that row of p is equal to minus Q yeah and this also means subjective because you know any Q if it's true for any Q then I mean if it can in if for any Q I can reach I mean minus Q is in the image then it's Al so for any Cube okay okay right but it's a bit more elegant this way uhuh cool thank you everyone okay so now let's let's go back

to the I remind you the construction of the whale pairing so we have um um we take Q in E of N and fq a rational function on e um such that the divisor fq is equal to n bracket Q minus n bracket o

um and um choose Q Prime Q prime it eventually turns out to be um in the N Square torsion points it's it's a easy um consequence but I want Q Prime such that um n q Prime is equal to Q how do I know that such a q Prime exist you remember think think a little bit it's

not hard we just like it's it's very related to the theory to proposition we could anyone will will it be that er um if uh one of them equals to zero then the second one also will be zero and it will be fair for any end but but why I mean how can I know that there exist Q Prime such that n q

Prime is Q I chose an arbitrary Q obviously if there it's just like I want to show that there exist Q Prime um in E of K if there exist Q such Q Prime it's obviously it's going to be um in N Square torsion points because when you multiply it by n you get q and and Q is an N torsion point so when you multiply it by n again you get zero but how do I know that there exist Q Prime in the K rational points on the curve such that n q Prime is is

Q you you can think of the Q Prime being like a already another Point multiplied by n so then when when you do n multiplied by n this other point so you are doing like n squ the point so then this is zero because you were in the nend to the two tortion points yeah I think you you got this part pretty much right but but forget about the fact that q q Prime is going to be an N Square torsion but for now I'm not interested

in that I just want to find Q Prime in a point on the curve such that n q Prime is equal to q and and Q all all I know about it is that it's an ENT point in fact a a um this this claim is true even if Q is not an endion point I mean the would always exist a q Prime such that e of K I mean such that n q Prime is equal to q and this this kind of statement is is is saying that some function is rejective what is the function but is it is it operate on an

algebraically closed K yeah we do only algebraically closed and eventually then I mean later on we could reduce everything that you say on an algebraically closed field happens in some large enough extension but but to clean up the the setup we we do algebraically close so do you use also the translation thing I do I mean almost translation yeah but I want to say I mean to say the Q

that to say the statement that I took some q and there exist Q Prime such that n q Prime is Q This is a statement about some function being subjective but which function it is it Nicholas do you do you have an idea no okay so okay it means we we need to to to recall it in more detail so um you take the multiplication by NM the multiplication by n map is a

rational map right we we really went into details of analyzing the multiplication by n map it had the two functions I mean FN and GN and we analyzed the the zeros and the poles this function is clearly not is not constant hence subjective but if it is subjective it mean what does it means to be sub objective it means for any Q here there exist Q Prime such that Q is equal

to multiplication by n evaluated at Q Prime do you see do you see the the issue here is it clear now why we we have such a q Prime yes and now so on the right you're getting that for any Q equals two multiplying n by Q Prime I mean I'm saying the the the M I have a multiplication by n map

the multiplication by n takes a point h r if you want and send it to NR okay this is a rational function right a rational map yes and it cannot be constant why can it not be constant this is a little bit of a trickier issue but it's not hard I mean if it was constant it means that well clearly um I get I get o right because n time o is

O So if it was constant it means that it would mean that it it needs to send everything to O which means that everything in E of K is n torsion points but but e of K is infinite because K is algebraically closed uhuh so so e of K cannot cannot be only n torsion for any end it cannot it has to I mean it has to be I mean something else so this map multiplication by n is not constant if it then it's subjective

what does it mean that it is subjective it means that for any Q I take in the in the C domain I there exist some Q Prime in the domain such that and I mean multiplication by n of this Q Prime is equal to Q cool okay that's that's like subjective means you can think about a subjective and injective intuitively is a s let's say injective is like embedding it's like a function that has

no repetition um for every input that I I give I mean for every two different inputs that I plug it in plug into it I get two different outputs and subjective means that all the outputs are covered that is for any output that I choose there exist some input that is mapped to this output okay all right so we choose but but as I think as now said because we we go into these elaborations

then it may be a bit hard to see the the overall picture so we take we take Q Prime that is um such that n n q Prime is equal to q and this Q prime it by definition it has to be an N Square torsion right because if I multiply it by n then I get q and Q is an N torsion point so

if I multiply by n again I get I get zero and now um um we con we consider the divisor D I write a DQ but it I mean it may appear to depend on Q Prime um this is the sum over all R in N of Q Prime + r minus

r and um we we showed that um we showed that DQ does not depend on the choice of Q Prime and is in fact a

principle so let a GQ be I mean the IR rational function such that the of GQ is equal to DQ and now we showed that a moreover let's say one is

that um GQ to the N is equal to fq composed with multiplication by n GQ to the n i I just want to stress it GQ to the n when you evaluate it on on some point P you just do GQ of P this is some field element then I can multiply it with G gqp and

times okay so when I say to the power of n i I just mean that I I multiply all the all the results of GQ evaluated at some at some point and we had this relation that GQ to the N is fq composed with n and we had another relation that for any s in in the K rational points um GQ of of S Plus P well for any s and for any um in torsion Point

P GQ of s + P the N is equal is equal to GQ of P to the n um and this means I E GQ of s+ P divided by GQ of

P to the end is always one and three and the the ratio GQ of s + P divided by GQ of P does not depend on the choice of s do you remember um how to um how to

prove three given H one and two or even just given two does it does it mean that ER we can see from two that it's just uh multiplying the thing from three and Times by itself so from from two we can conclude that the the ratio GQ of s + P ided

GQ of p is a root of unity yes and since it is the root of unity now I can and this is I chose arbitrary end torsion points p and Q okay and now so I I can think of this ratio in Orange as a rational function in s a rational function that is you take a a point on the curve and you evaluate

this expression you get some element in the field generally it's in in the projective line because you might get infinity but if I fix p and Q This is a rational function um from E of K into into the projective line right this rational function cannot be subjective so the the the expression GQ blank plus P divided by GQ um

actually yeah I should have written s sorry this has to be S um so this expression I I can regard as a function that takes an argument a point in the on the curve and gives me some element in the field or possibly Infinity so projective line and this function cannot be

subed why can it not be subjective it's constant no I I want to argue that this this function is constant if I if I can conclude that this function is constant then the the expression here in Orange does not depend on S because for any s you get the same thing you get some some constant right so so this the the the claim in in in three here in green would would follow from arguing that the the ratio here in Orange is um I mean

the the the function here in Orange is is constant but in order to show that it's constant I need to rule out that it is subjective right there there could be only so how can I rule out that it is subjective it's because the rotes of unity like so all of all of the things that you fit in will end up into one yeah like repeating repeating output exactly you're you're completely right because here in in the projective line I have the roots of unity this is denoted

as Mu n of K and mu n of K is is Solutions of the pols it's like zero zeros of the polom um x to the N minus one and there could be at most n zeros so if I I know that this expression always lands here it means that this function in Orange cannot be SED okay is this is this okay now

Lisa and and now I I simply Define definition the wh pairing of um p and Q in N torsion points is m i denote e n PQ this is this ratio GQ of S Plus P divided by GQ of s

and and this is of course um this is a function from um so I write n from E of bracket n times itself because I I I need to give two arguments to this function and I land um I can either write K or I can write in fact mu I mean mu n of k um but but either way I get a function that

is never Infinity so it's always some some value in the field okay and now we want to prove some um some properties about the function yeah yeah is there question so we want to prove a a um several properties the first property oh I'm sorry I asked the question without the mic yeah uh should it be P plus Q on the app and not S Plus P No it should be S

Plus P so the Q the Q this is kind of a a strange definition I mean the Q is involved when you when you construct GQ but what is GQ GQ is some function whose divisor is this expression oh right okay I know it's like it's it's a it's kind of involved to remember it all but and this is the only thing we know about GQ yeah it's a function characterized by the fact that it

is it has some divisor some prescribed divis okay okay so this is this is the def this is I mean this is the first definition um eventually there are several equivalent definitions but ER in this definition you will see that ER we can prove most of the properties we want ER with no big effort let's say so I call it in the notes I call it the abstract whale

pairing um and there is another section that H gives an alternative definition of the well pairing and show why these two definitions are equivalent but for now we we use the abstract definition and the first property I want n is bilinear i e for

any um P1 let's say by linear it has two um two Clauses first for any P1 and P2 in E if I do n of and for any and for any Q um if I do en n of P1 plus

P2 paired with Q I get En n of P1 Q multi multiplied by n P2 and this multiplication is the multiplication in K okay and this addition of course is addition in and the second part of bilinear is that for any q1

well for any p and any q1 sorry q1 and Q2 in E if I do n of p q1 + Q2 then it's the same same as n p q1 times n p okay so this is a bilinear is like

linear in both of the in both of the arguments in both of the variables so if you fix one variable and you you take a sum of a ER a sum of things in the other variable then you get the product of the um of the the two independent terms is the is the statement clear by linear yes okay and this you probably saw before um but it's time for a break so let let's meet in 10 minutes

e e e

e e e

e e e

e e e

e e e

e e e

e e e okay so um so let's let's prove a

bilinearity um let let us first linearity and in the first variable so since d n is

independent of the choice of s um we can write and basically I do e n P1 Q multiplied by n P2 q and this is well the the first term I I just do as as is I mean as the definition this is like GQ of s+

E1 divided by GQ of s and the first the the second term I do um GQ of s + p1+ + P2 divided by GQ of s + P1 you see what what I did here is I took some S I chose some s to um to

calculate e n of P1 q and then I chose another s namely S Plus P1 this is you can call S Prime in order to calculate the N of p2q okay but this is equal to um well now now this is H this is cancelled right I need another

color I mean this is now cancelled with this and I'm left with a GQ of s+ T1 plus P2 divided by GQ of s and this is by definition n of P1 + P2 comma Q okay so I get linearity in the first variable is this clear

okay so and now you need to you need to to understand that um the way we defined ER the we pairing it's not evidently symmetric so it's not like I can say okay we did it in the first variable and now just do a symmetry argument and it's it means that also it's linear in the second variable the the in the second variable when I change Q I change Q in the the GQ and this is a a prior it's something different so you will see that um for the second

argument for linearity in the second argument second variable um suppose q1 Q2 and Q3 are intorsion points such that q1 + Q2 is equal to

23 and for I equal 1 2 or 3 let fqi and gqi b as in the in the construction and above okay so um what does it mean oh let me let me just add another thing let H be some rational

function such that ER div H is equal to bracket Q3 minus bracket Q2 I need more space AG is bracket Q3 minus bracket Q2 minus bracket q1 plus o plus bracket

o you see what I did here I know that q1 plus Q2 is Q3 so if I take this divisor you can see that the obviously the degree of this divisor is zero because I have um integer coefficient one integer coefficient minus one minus one and one this this sums to zero but I also need the the the sum of the points to be equal to the point at Infinity on E but that's that's also okay because q1 plus

Q2 is equal to Q3 so I know by just writing this divisor I know that there exist I mean this is a principal divisor so there exist a function age whose divisor is precisely this and and now I have um the following I take the divisor of fq3 divided by fq1 multiplied by fq2 what is

it I mean the remember the the divisor of fqi is n Qi minus n o and the divisor of um er a quotient is the the difference of divisors so this is like um D fq3 minus D fq1 multiplied by

fq2 but the divisor of of a product is the is sum of divisors so this is d fq3 minus D fq1 minus D fq2 and um and now I know I know that the divisor of fqi is this H is this expression so I get n Q3 minus n o um minus

nq2 plus n o minus nq3 sorry nq1 plus n o and this is um I mean this is n times Q3 and minus Q 2us

q1 Plus o and this is simply n times the divisor of H and N times the divisor of H is the divisor of H to the N okay so I get I get this the the divisor of the quotient of the fs here in in Orange is the divisor of H to the end can you follow

this I follow this but I don't understand why are we looking at this special divisor fq3 over fq1 time fq2 yeah soon this I soon all the parts will uh be brought together um so without loss of generality if if two functions have the same divisors they are equal up to a constant up to a multiplication by constant so um actually and so there exist some

constant in K such that fq3 divided by fq1 fq2 is equal to a a constant times hn which is the same as saying that fq3 is equal to C * fq1 fq2 time H to the n um and now

recall yes why is that c not just one or does I I could I could take C to be equal to one it's a it's not going to matter it would be cancelled out eventually no maybe my question is more like why can it be over anything else than one because two functions that have the same divisor are not necessarily equal I mean just take any just take even a a polom so a rational function without a a denominator ER multiply it by a constant it will have the same zeros and the same

pulse right of also the same multiplicity makes sense um okay so now we know also that g Qi to the N is equal to fqi composed with n this is part of the construction um and now so it means that I can I I write gq3 to the N this is by defin fq3 composed with multiplication by n and fq3 I I replace by this

expression so I write c times fq1 * fq2 * H to the N composed with multiplication by n and now what does it mean to um do multiplication by n on a product of functions this is the same as doing well to multiply by a constant it doesn't matter I just leave it outside it's the same as doing fq1 composed with

n times fq2 composed with n times H to the N composed with n okay because if you if you want to evaluate a point you have this function in green and you want to plug in a point what do you do you first multiply the point by n and then you do the product of the functions this is like C * F U1 evaluated at NP times F Q2 evaluated at

NP times H to the N evaluated at NP okay so it's it's the same as just doing each of these functions separately composed with with n is this step clear Lisa what do you think I think it's fine okay and now I do the same trick but with h to the n h to the N is just H times H * h n times so if I compose it with multiplication by N I

might as well do fq1 n f Q2 comp POS n times um H composed n multiplied by itself n times and now I I PE I I I shrink again I mean fq1 composed with n is is simply gq1 to the nend right so gq1 to the

n and then here I have gq2 to the end and the last thing do I want to unpack it well I leave I leave the L thing as as it is is H composed with n with the N okay so I get this orange orange thing is equal to the orange thing in the in the end so taking a n fr

we get G Q3 is equal to the N root of c times gq1 time gq2 times H composed with n and how do I know that I can take n n root of C anyone how do I know

that what is n nth root of of c c is just an element in a field K because we know that c is Al K is algebraically closed we will know that it exists yeah I mean n roots of C is simply a solution of the polom X to the N minus C okay it's not necessarily unique but um but I can take I I can just choose one H and okay so now I get a I get an interesting relation between the

gqs and I can I can go to the definition so now I take um n [Music] of P comma q1 plus Q2 this is equal to by by definition I mean q1 + Q2 we said that this is Q3 so this this is by definition gq3 of s +

e divided by gq3 of s but gq3 I can replace by this product gq1 gq2 and this H composed n and um since I have a quot gq3 of something divided by gq3 of another thing the the constant H whatever it is er cancels out so I can ju just write gq1 of s+ P time gq2 of s +

P time H composed n of s+ P divided by gq1 of s time gq2 of s times H composed n of s and I further unravel namely the last term of H composed with n so I get a

gq1 of s+ p gq2 s + p and the last term is basically h of NS plus NP right but what is NP zero zero right because p is an intorsion point so I I I might as well just write NS age of NS and here I have gq1 s+ p

g sorry not S Plus s s gq2 of s times again h of NS so the H NS cancels out and now I get exactly you see here the orange is um n of a p q1 and the green is n okay and this this finishes the proof

right we started with the with n of P q1 plus Q2 and we ended up with the problem so I get linearity in in the second variable now any questions I understand technically what we did but I don't understand why is it so different for the first variable and for the second variable well because for the second variable I need to let the GQ vary so you see in the first variable I let I let P vary so I I have P1 and P2

right right so and this is quite easy in the definition because you just put either a GQ of s+ P1 divided by GQ of s or you do GQ of well another s s Prime plus plus P2 divided by GQ of this S Prime and if you carefully choose the S Prime you you see that you get the same h i mean you get the linearity but for the second variable it means that I need to let Q vary to let Q vary it means that I need to I need to inspect what is the the relations between a g GQ

1 G Q2 and G of q1 + Q2 ah right I understand and that's that's a it's a different issue it's like yes so so that's why the proof is not symmetric because also the definition is not evidently symmetric it would turn out to be H what is called SK skew symmetric but er um we will get to it I mean uh but like like semantically speaking can't we just have replace um we couldn't have used gp1 or gp2 like no it's not it's not the

definition I mean the definition we gave means that the G you choose you choose it based on the second ER the second variable point it's not the I mean of course you can claim that maybe I could cook up a definition in which G it depends on the on the first variable point and you could do something like that but it's not going to be exactly the same okay you would need to to to tweak it So eventually when I mean when we need to prove we need to we need to make a different argument for each

variable okay um I kind of let let's see I think we can do the second property but maybe not coning so the second property yeah actually the the okay and N is this is

called Q symmetric IE first um n if you plug in the same Point q n q it's equal to one for any for any ENT point and two n of p plus Q sorry P paired with Q is the same as n of Q paired with P minus

one and this minus one one is in the field right because n of PQ is is just an element in the field okay so let to J Q be the translation so this is from E of K

okay can you repeat once again the second thing means that ER the pairing of each two elements equals the inverse of the same but in another order yeah so it means if you now replace the order of p and Q I mean both of them are endion points so they both of them could could be plugged into to either of the arguments right um so if you do en n of PQ or yeah I guess if you if you replace the the

order then you get the inverse of what you got in the in the original order and the inverse it means the inverse in K right this is in K I mean n PQ or n QP is an element in K so you can take the inverse it's a it's a nonzero element also I should say but how do we know it's a nonzero element anybody how do I know that e npq is never zero never the zero element in

K because it's it belongs to one of the roots of unity exactly zero is not a root of unity okay so let's let to JQ be translation by translation by JQ i e um this I'll just write it in a different color here so you take some p and translation by JQ sends it to p+ J Q this for some I mean J is some um some

positive integer or in fact some integer um and now um so I can take for um a rational function f f composed with to JQ evaluated at p is just F of p plus

JQ right this is just to remind you how how this H composition with translation works and observe that now I I take the yes uh sorry why do you say G is in Z shouldn't be in the Scala field no j j is a I mean q is a point on the curve J is going to be between H between zero and N minus one eventually I

mean right okay so I claim now that yes Nicholas no no it's just from a Dev perspective use as J being in the prime field of the I mean the scal field scal field but here is not the case and so you SC multiplication with something which is not in a scal field so that's why I'm a bit um no I mean you know you can take any integer you have an elliptic curve you can take any integer and multiply this I

mean what is JQ it's just Q Plus Q Plus Q JS yeah yeah makes sense um okay so now I claim that so I want to evalue I have this F fq right so we call um fq um is such that the divis of fq is

NQ minus n o and um now I want to evaluate the divisor of fq composed with to of JQ I claim that this is similar to an argument we did last time this this is Q minus J Q minus n minus

JQ and why is that we need I mean we know that the the zeros of of fq I mean fq is has only one zero Q um and the the the order of the zero is n and it has a a one pole at o now if I do the the composition of fq with with translation by JQ then basically the divisor translates I mean a translation is a is a bjective

map on the the points on the curve so it's not like many points are mapped into Q the only point there is one point that is mapped into Q under this for this composite function and this point is Q minus JQ because Q minus JQ plus translation will will be M to M to Q so Q minus J Q is a zero of the composition and minus JQ is uh is a pole of of this composition and both of them have the same or order so this is not a formal

proof but you can prove it with the with uniformis say maybe it's good to put it as an exercise H is this is this point clear modul the things I didn't prove it is it intuitively clear why the divisor of of the composite would need to be like this

intuitively I think we can assume that yes okay that's that's what I'm saying I mean we're like in a bit of a time pressure so I don't want to prove prove all of it but it's not hard it's the same argument that we we mentioned last time I mean this translation by minus Q is bjective so it's essentially it just translates all the zeros and the poles of a given function um and it keeps the same multiplicity and okay so now I'm going to do like a massive product is

I take the divisor of the product j = 0 up to nus one of fq composed with translation by JQ this is equal to I mean the divisor of a product is the sum of divisors H and divisor of each of the individual factors we know so this is the sum of JAL 0 up to n minus one of n q minus J Q minus n minus

JQ H and you can see that H that this is actually is going to be zero because the all the terms they cancel cancel out each other right I have like um let's see so when J is equal to zero I have um in the green part I have NQ n bracket q and in the orange part I have n n bracket o right so let's let's just do it in

another color so J J equal Z I get n q minus N O J equals 1 I get n q minus Q which is n0 minus and of minus right so you see this one is canceling with this one and let let me just continue a little

bit to show you the principle so J equals 2 I have n of Q minus 2 Q is minus Q n of minus q and minus n of umus 2 so this and this cancel out as well and eventually everything will cancel out okay when I mean when n is equal to sorry when J is equal to uh n minus

one then I get um n * minus n what is it nus one 1 - n -1 is - n minus n q and no sir okay

nus do M - n -1 2 is 1 -- one um yeah so it's okay so it's minus nus n a and then minus n Min - nus

one means that it's okay- nus one and um as you can expect this guy is going to cancel out with this guy and when I do here minus n - one Q this needs to be this needs to cancel out with the the first term and something is just a minute

oh yes so here it's it's always does it have something to do with Q being torsion point that NQ will be yeah zero yeah I guess so so minus nus one is going to be I mean minus n q is going to be zero and and then minus minus yes so exact exactly this so this is this is NQ because Q is a torsion point so this

is minus n q is zero because n q is zero and then minus minus one of Q is is Q so so this cancels and here I have the minus this cancels with this so all in all I get that this the divisor of this function is zero um and if if this is a function with div zero it means that it's constant so the product of fq composed to JQ J goes from zero to nus one is

constant now let me do a slightly different massive product which is product of and again from the same index of GQ composed with to of J Q prime a q Prime such that n q Q Prime is equal to Q I take this this massive product and I

raise it to the end power GQ so if I have this I I I I might as well replace GQ to the n h with fq so this is first of all when you do to the N power you just you can just do n power on each of the of the factor of the composition so this is GQ to the nend [Music]

so yeah so um so this is I can do it let write it like this this is going to be fq composed n composed with to of J Q yes uh why why did we decide to take Q Prime only for the translation because I mean exactly because of this equality I'm it's kind of hard to explain all the picture before completing the

argument um but okay and transformation will follow from the definition of NQ Prime equals Q yeah yeah I mean basically I I want to prove that this expression here I mean with the two two line and two underlines is is also constant and then I could take an nth root which means that it's also going to be constant ER and then you'll see I mean um sorry I I don't have a better answer but it's kind of hard to explain the whole argument and no no it's fine thank

you so but I'm claiming just as as functions this is not this is not you have this equality because GQ to the N is equal to fq composed with translation by multiplication by n so and instead of I mean in multiplication by n on translation by JQ Prime is is basically just translation by JQ because NQ Prime is is equal to Q so so now I get

um yeah actually sorry here there is still a uh a j a transition by JQ yes yes so so let me just expand a little bit here we have a GQ composed with translation by JQ Prime to the um to the N power so so I definitely get like um

many terms like this I'll write it so if I do GQ composed with translation by J Q Prime multiplied by itself n times

then what I can do I mean this basically the same argument that we we talked about before this multiplication is is Comm I mean commutes with the composition because when you evaluate at the point P you need to do a GQ of of whatever the translation of this point by JQ Prime and then you need to multiply by I mean all the other things that our evaluation of of that point this is just GQ of um

p+ and JQ Prime Times itself many times n times and this is the same as doing um GQ evaluated at the point p and times and multiply by itself n times composed with J so um or yeah let me just write it like this G GQ and

times composed with to JQ Prime evaluated at P right this is a these these two expressions are so so I get that I can write this this massive product GQ composed with JQ Prime composed with the to JQ Prime as this fq composed with n because GQ GQ to the N is fq composed with n and so I can rewrite this this term as a as

a product and we basically ran out of time so I I guess we will need to H to continue next time um but a question so far all right so uh let's H let's get again next week we complete I think we can complete most of the welling this we how many claims do we have H you can look in the notes but basically we did the we don't have to do all the

properties because not all of them are um really essential for a for implementations um but let's see I have in the main theorem this is six 144 it has eight eight closes we did the first two H well the first three we did today ER the fourth we um we are like halfway and then basically then we just need the nand

generation which is not going to be hard so I think next time we can complete all the I mean all the relevant properties of the well pairings that are essential for the implementations okay thank you all right so uh see you next week bye awesome thank you very much by bye