EFp2

EFp2 denotes the quadratic extension field of the prime field Fp, i.e., the finite field with p^2 elements. It is constructed by adjoining an element i to Fp with the relation i^2 = d, where d is a non-square in Fp. Equivalently, EFp2 can be described as the quotient ring Fp[x]/(x^2 − d). Elements have the form a + b i with a and b in Fp. When the standard choice d = −1 is used, i^2 equals −1 in Fp, but many parameter sets use other non-squares.

Arithmetic in EFp2 is similar to complex arithmetic but taken over Fp. Addition and subtraction are componentwise: (a + b i) ± (c + d i) = (a ± c) + (b ± d) i. Multiplication uses the rule i^2 = d: (a + b i)(c + d i) = (ac + bd d) + (ad + bc) i. Inversion is given by (a + b i)^{-1} = (a − b i) / (a^2 − b^2 d), provided a^2 − b^2 d ≠ 0; the denominator is the norm N(a + b i) = a^2 − b^2 d in Fp. The Frobenius endomorphism, which raises elements to the p-th power, is efficiently computable and acts on coefficients with a fixed, precomputable factor related to d.

EFp2 plays a central role in pairing-based cryptography. It serves as the base field for quadratic twists and for intermediate computations in many pairings, where one of the input elliptic curve groups is defined over Fp^2 and the target group often resides in a higher-degree extension. The field’s two-dimensional representation and its efficient arithmetic enable practical implementations of Tate and Weil pairings, as well as optimized Miller’s algorithm, in various curves such as BN and BLS families.