From this blog post: https://medium.com/@VitalikButerin/exploring-elliptic-curve-pairings-c73c1864e627

if P = G * p, Q = G * q and R = G * r, you can check whether or not p * q = r, having just P, Q and R as inputs.


It's easy to see p * Q = q * P = R. But I don't see the leap to proving p * q = r.

  • 1
    $\begingroup$ That's the point; you cannot do that (at least, it's unknown how to do that) on a standard elliptic curve - it is possible on a 'pairing friendly curve', that is, one where there's a computable e() blinear function. Keep on reading... $\endgroup$
    – poncho
    May 8 at 12:38

1 Answer 1


The Weil Pairing is a bilinear pairing, which is a function $e$ that maps two points in a pairing friendly elliptic curve $E(\mathbb{F}_q)$ to an element in the finite field $\mathbb{F}_{q^k}$, where $k$ is the embedding degree associated with the curve.

If the elliptic curve's generator is $G$ & $a$ & $b$ are scalars, then the bilinearity means that $e(aG,bG) = e(G,G)^{ab}$.

We know $P$, $Q$, $R$ & $G$.

So, we can calculate the following values in $F_{p^k}$


  1. $v_1 = e(P, Q)$
  2. $v_2 = e(G, R)$


$e(P, Q) = e(pG, qG)$

Now because of the bilinearity, this is also equal to $e(G,G)^{pq}$

Likewise, $e(G, R) = e(G, rG) = e(G,G)^r$

So if $v_1 = v_2$, then it means,

$e(G,G)^{pq} = e(G,G)^r$

which means $pq = r$

Thus, we can check if $pq \stackrel {?}{=} r$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.