# linear computations over bilinear pairings

Does this hold in asymetric bilinear pairings?

$e(x_1,x_2)e(x_3,x_4) = e(x_1x_3,x_2x_4)$, where $x_1,x_3 \in \mathbb{G}_1$ and $x_2,x_4 \in \mathbb{G}_2$ for a bilinear pairing $e$

## 2 Answers

I use multiplicative notation for $\mathbb{G}_1$ and $\mathbb{G_2}$ (as in your question) as this may make it a bit clearer for you. Lets say the groups are of prime order $p$ and and lets consider your elements w.r.t. bases $g_1$ and $g_2$. Lets write your elements $x_1$ and $x_3$ as $g_1^{a_1}$ and $g_1^{a_2}$ and $x_2$ and $x_4$ as $g_2^{b_1}$ and $g_2^{b_2}$ respectively.

Then lets look at your equation $e(x_1,x_2)e(x_3,x_4) = e(x_1x_3,x_2x_4)$.

We just use bilinearity below. You see that on your left hand side you have $$e(g_1^{a_1},g_2^{b_1})e(g_1^{a_2},g_2^{b_2})=e(g_1,g_2)^{a_1b_1+a_2b_2}$$ Lets take a look at the right hand side $$e(g_1^{a_1}g_1^{a_2},g_2^{b_1}g_2^{b_2})=e(g_1^{a_1+a_2},g_2^{b_1+b_2})=e(g_1,g_2)^{(a_1+a_2)(b_1+b_2)}=e(g_1,g_2)^{a_1b_1+a_2b_2+a_1b_2+a_2b_1}$$ Now if your equality should hold you need to have that $a_1b_2+a_2b_1=0$ (in $\mathbb{Z}_p$) or in other words $e(g_1,g_2)^{a_1b_2}e(g_1,g_2)^{a_2b_1}=e(x_1,x_4)e(x_3,x_2)=1$. So as Thomas has already written this is not true in the general case.

• Is there a book or a reference that will talk about pairings? – BlaX Aug 12 '14 at 23:02

For clarity, I will use an additive notation in the groups $\mathbb{G}_1$ and $\mathbb{G}_2$, and denote group elements with the "$x$" letter, not "$e$".

For all $x_1, x_3 \in \mathbb{G}_1$ and $x_2, x_4 \in \mathbb{G}_2$, we have the following:

\begin{eqnarray*} e(x_1 + x_3, x_2 + x_4) &=& e(x_1, x_2 + x_4) e(x_3, x_2 + x_4) \\ &=& e(x_1, x_2) e(x_1, x_4) e(x_3, x_2) e(x_3, x_4) \end{eqnarray*}

(First equation is by linearity of the pairing for its first operand, second equation is by linearity for its second operand.)

Therefore, one can have the property you seek only when $e(x_1,x_4)$ and $e(x_3,x_2)$ happen to be opposite of each other, which is not true in general (unless the pairing is degenerate, in which case it is quite uninteresting).

• It's not very clear to me what does it mean for $e(x_1,x_4)$ and $e(x_2,x_3)$ to be opposite... – curious Aug 12 '14 at 17:31
• Two elements in a group are opposite to each other if their product is 1 (or their sum is 0, if you use an additive notation for the group). – Thomas Pornin Aug 12 '14 at 17:34
• if $x_2=g_2^{r_1}$ and $x_4=g_2^{r_2}$ does anything change for $r_1, r_2 \in \mathbb{Z}_p$ – curious Aug 12 '14 at 17:38