Why the definition of bilinearity property is different in cryptography compared to mathematics?

Question

Background:

In Wikipedia (bilinear map definition), a condition listed as the following:

For any $\lambda \in F, {\displaystyle B(\lambda v,w)=B(v,\lambda w)=\lambda B(v,w)}$

---

In a math.stackexchange post, i saw this comment:

which defines bilinearity in the same way as the Wikipedia link. So I assume, the above definition of bilinearity is correct.

---

Now, the problem:

in the pairing-based cryptography setting:

the bilinearity is defined as such: ${\displaystyle \forall a,b\in F_{q}^{*},\ \forall P\in G_{1},Q\in G_{2}:\ e\left(aP,bQ\right)=e\left(P,Q\right)^{ab}}$

The question:

in math: bilinearity is: $e\left(aP,bQ\right)=e\left(P,Q\right)ab$ (a and b have become coefficients)

in crypto: bilinearity is: $e\left(aP,bQ\right)=e\left(P,Q\right)^{ab}$ (a and b have become exponents)

Why is this difference? Aren't the definitions conflicting with each other? In wicktionary I saw the following explanation:

Linear (preserving linear combinations) in each variable.

How come $e\left(aP,bQ\right)=e\left(P,Q\right)^{ab}$ is preserving the linear combinations? Isn't exponent and coefficients are very different and not linear with each other?

Obviously, math is correct, and crypto is also correct. So, I really appreciate if someone can point out to me where am I missing the details or misinterpreting them?

P.S: someone in crypto.stackexchange defined the bilinearity as:

Bilinear: for all g ∈ 𝐺1 and a; b ∈ $Z_{q}^{*}, e(g^a, g^b) = e(g,g)^{a,b}$

I haven't seen this notation at all. Is the definition of bilinearity loose? So there can be multiple definitions? If so, why and how?

Answer 1

Why is this difference?

The difference between $e(P, Q)ab$ and $e(P, Q)^{ab}$ is entirely notational; there is no real difference at all.

There are two traditional ways to express the group operation:

• As an analogue with addition; in this notation, the operation is expressed as $P + Q$; hence scalar multiplication is denoted as $\underbrace{P+P+...+P}_{n \text{ times}} = nP$ (or $Pn$)

• As an analogue with multiplication; in this notation, the operation is expressed as $P \times Q$ (or $P \cdot Q$ or $PQ$); hence the scalar operation is denoted as $\underbrace{P \times P \times ... \times P}_{n \text{ times}} = P^n$

Both ways of writing things mean exactly the same thing; the difference is solely in how we choose to spell it.

Now, for some groups, we typically write them in additive form, and that's what the mathematical formulii do. In cryptography, the result of pairing operations that we use in practice is an element of a finite field group, and for those groups, we almost always write them in multiplicative notation; that's what the formulii you see reflect.