Does the following hold in bilinear pairings? $$e(g^{a_1x_1}g^{a_2x_2},g^{c_1}g^{c_2})=e(g^{x_1+x_2},g^{a_1a_2(c_1+c_2)})$$

  • 1
    $\begingroup$ Only for $x_1=0 \wedge x_2=0$. $\endgroup$
    – Artjom B.
    Commented Oct 16, 2014 at 7:25

1 Answer 1


Yes, sure, in some cases. In the following I assume that we speak about pairings as used in cryptography.

Lets look at the trivial case, i.e., when your equation reduces to $1_{G_T}=1_{G_T}$ where $1_{G_T}$ is the identity in your target group $G_T$. Then any assignment of your variables that makes at least one input element of each pairing the element $g^0=1_G$ ($1_G$ the identity in your group $G$) makes the equality hold. Note if you have $e(a,g^0)=e(a,1_G)=1_{G_T}$ (Observe that for any $a,b \in G$ you have $e(a, b) = e(a, b\cdot 1_G) = e(a, b) \cdot e(a, 1)$ and thus $e(a, 1)=1_{G_T}$). For instance, as in @Artjom B.s example for the case $x_1=x_2=0$.

For the non-trivial case it is quite easy to see that $a_1=a_2=1$ makes the equation hold.

  • $\begingroup$ Maybe it was not clearly defined but the setup is for any randomly chosen $a_1,a_2$ and $x_1,x_2$ $\endgroup$
    – curious
    Commented Oct 16, 2014 at 9:26
  • 3
    $\begingroup$ @curious. Then, only with negligible probability (meaning in practice NO). $\endgroup$
    – DrLecter
    Commented Oct 16, 2014 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.