Assuming we have fixed pairing friendly elliptic curve groups $G_1$, $G_2$ and $G_T$ where for $a \in G_1$ and $b \in G_T$ it holds $e(a,b) \in G_T$.

Let's put some more context and we are working in bls12-381. what is a standard way to compute $e(a,b)*r$, where r is a random bit string. Putting in another way how do we map bitstrings to the target group $G_T$ ?


1 Answer 1


Using bls12-381 the group $G_T$ us a multiplicative subgroup of $GF(p^{12})$ of order $\ell$ for a certain 381-bit prime $p$ and 256-bit prime $\ell$. We can convert a random bitstring to an element of $GF(p^{12})$ by hashing a to a uniform integer in $[0,p^{12}-1)$, expressing this integer in base $p$ and extracting the digits to use as coefficients in whatever basis we choose to represent $GF(p^{12})$. We can then map this element of $GF(p^{12})$ to our subgroup $G_T$ by raising to the power $(p^{12}-1)/\ell$.

  • $\begingroup$ What if you want to recover back that r from its encoding to $[0,𝑝^{12}−1)$ ? $\endgroup$
    – curious
    Dec 30, 2023 at 16:55
  • $\begingroup$ @curious: That is not computationally easy using this method. Typically protocols only require the ability to hash into the group. $\endgroup$
    – Daniel S
    Dec 31, 2023 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.