Does the following hold in bilinear pairings? $$e(g^{a_1x_1}g^{a_2x_2},g^{c_1}g^{c_2})=e(g^{x_1+x_2},g^{a_1a_2(c_1+c_2)})$$

  • 1
    $\begingroup$ Only for $x_1=0 \wedge x_2=0$. $\endgroup$
    – Artjom B.
    Oct 16 '14 at 7:25

Yes, sure, in some cases. In the following I assume that we speak about pairings as used in cryptography.

Lets look at the trivial case, i.e., when your equation reduces to $1_{G_T}=1_{G_T}$ where $1_{G_T}$ is the identity in your target group $G_T$. Then any assignment of your variables that makes at least one input element of each pairing the element $g^0=1_G$ ($1_G$ the identity in your group $G$) makes the equality hold. Note if you have $e(a,g^0)=e(a,1_G)=1_{G_T}$ (Observe that for any $a,b \in G$ you have $e(a, b) = e(a, b\cdot 1_G) = e(a, b) \cdot e(a, 1)$ and thus $e(a, 1)=1_{G_T}$). For instance, as in @Artjom B.s example for the case $x_1=x_2=0$.

For the non-trivial case it is quite easy to see that $a_1=a_2=1$ makes the equation hold.

  • $\begingroup$ Maybe it was not clearly defined but the setup is for any randomly chosen $a_1,a_2$ and $x_1,x_2$ $\endgroup$
    – curious
    Oct 16 '14 at 9:26
  • 3
    $\begingroup$ @curious. Then, only with negligible probability (meaning in practice NO). $\endgroup$
    – DrLecter
    Oct 16 '14 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.