Proving scalar multiplication given elliptic curve points

Question

From this blog post: https://medium.com/@VitalikButerin/exploring-elliptic-curve-pairings-c73c1864e627

if P = G * p, Q = G * q and R = G * r, you can check whether or not p * q = r, having just P, Q and R as inputs.

How?

It's easy to see p * Q = q * P = R. But I don't see the leap to proving p * q = r.

Answer 1

The Weil Pairing is a bilinear pairing, which is a function $e$ that maps two points in a pairing friendly elliptic curve $E(\mathbb{F}_q)$ to an element in the finite field $\mathbb{F}_{q^k}$, where $k$ is the embedding degree associated with the curve.

If the elliptic curve's generator is $G$ & $a$ & $b$ are scalars, then the bilinearity means that $e(aG,bG) = e(G,G)^{ab}$.

We know $P$, $Q$, $R$ & $G$.

So, we can calculate the following values in $F_{p^k}$

Let

1. $v_1 = e(P, Q)$
2. $v_2 = e(G, R)$

Now,

$e(P, Q) = e(pG, qG)$

Now because of the bilinearity, this is also equal to $e(G,G)^{pq}$

Likewise, $e(G, R) = e(G, rG) = e(G,G)^r$

So if $v_1 = v_2$, then it means,

$e(G,G)^{pq} = e(G,G)^r$

which means $pq = r$

Thus, we can check if $pq \stackrel {?}{=} r$