Proving scalar multiplication given elliptic curve points

if P = G * p, Q = G * q and R = G * r, you can check whether or not p * q = r, having just P, Q and R as inputs.

How?

It's easy to see p * Q = q * P = R. But I don't see the leap to proving p * q = r.

• That's the point; you cannot do that (at least, it's unknown how to do that) on a standard elliptic curve - it is possible on a 'pairing friendly curve', that is, one where there's a computable e() blinear function. Keep on reading... Commented May 8, 2023 at 12:38

The Weil Pairing is a bilinear pairing, which is a function $$e$$ that maps two points in a pairing friendly elliptic curve $$E(\mathbb{F}_q)$$ to an element in the finite field $$\mathbb{F}_{q^k}$$, where $$k$$ is the embedding degree associated with the curve.

If the elliptic curve's generator is $$G$$ & $$a$$ & $$b$$ are scalars, then the bilinearity means that $$e(aG,bG) = e(G,G)^{ab}$$.

We know $$P$$, $$Q$$, $$R$$ & $$G$$.

So, we can calculate the following values in $$F_{p^k}$$

Let

1. $$v_1 = e(P, Q)$$
2. $$v_2 = e(G, R)$$

Now,

$$e(P, Q) = e(pG, qG)$$

Now because of the bilinearity, this is also equal to $$e(G,G)^{pq}$$

Likewise, $$e(G, R) = e(G, rG) = e(G,G)^r$$

So if $$v_1 = v_2$$, then it means,

$$e(G,G)^{pq} = e(G,G)^r$$

which means $$pq = r$$

Thus, we can check if $$pq \stackrel {?}{=} r$$