Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The bilinear map in Identity-based encryption should satisfy $e(aP,bQ)=e(P,Q)^{a\cdot b}$ whereas Attribute-based encryption schemes use $e(P^a,Q^a)=e(P,Q)^{a\cdot b}$ with $a,b\in\mathbb{Z}_p$ and $e:\mathbb{G}_1\times\mathbb{G}_2\rightarrow\mathbb{G}_T$.

Why are they different and are there reasons to prefer one over the other? Are they fixed in their purpose?

share|improve this question
Where did you get these definitions? The only difference is that the first is written additively (which is what it is since it is elliptic curves). The second is written multiplicatively (which some authors use for consistency). They are the same though. – mikeazo Apr 24 '14 at 17:50
Hadn't thought about checking that $aP=P^a$ – Artjom B. Apr 24 '14 at 18:02
Let me explain clearer $aP\neq P^a$. It is just a notational choice by the authors of the papers you are looking at. Some prefer to write things multiplicatively, others choose to write it additively. – mikeazo Apr 24 '14 at 18:07
up vote 4 down vote accepted

There really isn't a difference. It is just author preference in notation. Some authors prefer to write the pairing operations multiplicatively $e(P^a, Q^b)=e(P,Q)^{ab}$ while others prefer to write it additively $e(aP,bQ)=e(P,Q)^{ab}$.

This comes from the fact that in $e : \mathbb{G}_1\times \mathbb{G}_2\to\mathbb{G}_T$, $\mathbb{G}_1$ and $\mathbb{G}_2$ are (typically) elliptic curve groups, in which the group operation is additive, while $\mathbb{G}_T$ is a multiplicative group. Thus some authors might prefer to make the additive notation of the elliptic curve groups more explicit while other others prefer to make the notation more consistent.

share|improve this answer
So the most meaningful notation would be $e(aP,bQ)=ab\cdot e(P,Q)$ as you cannot multiply two curve points together which the other notations imply. – Artjom B. Apr 24 '14 at 20:05
No, the pairing maps to $G_T$, which is always a multiplicative group. – DrLecter Apr 24 '14 at 20:08
@artjomb the target group is not an elliptic curve group. – mikeazo Apr 24 '14 at 23:05
@drlecter thanks for the correction. – mikeazo Apr 24 '14 at 23:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.