%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
                    % \section{Pairing-Based Cryptography} %
                    %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\subsection{Bilinear maps}
\begin{definition}[Pairings~\cite{BSS05}] \label{de:pairings}
  A pairing is a map $e: \GG \times \Gh \to \GT$ over cyclic groups of order $p$ that verifies the following properties for any $g \in \GG, \hat{g} \in \Gh$:
  \begin{enumerate}[\quad (i)]
    \item bilinearity: for any $a, b \in \Zp$, we have $e(g^a, \hat{g}^b) = e(g^b, \hat{g}^a) = e(g, \hat{g})^{ab}$.
    \item non-degeneracy: $e(g,\hat{g}) = 1_{\GT} \iff g = 1_{\GG}$ or $\hat{g} = 1_{\Gh}$.
    \item the map is computable in polynomial time in the size of the input.
  \end{enumerate}
\end{definition}

In practice, pairings are computed over