Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
According to wiki's definition of Bilinear pairing…
Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A pairing is a map: $e: G_1 \times G_2 \rightarrow G_T$ but, there also have different definition such that $G_1$ and $G_2$ be two multiplicative cyclic groups.
How is the decision made if $G_1$ and $G_2$ are two additive cyclic groups or multiplicative cyclic groups?
Notation is basically a free choice of the author, as they describe functionally the same. And there is no fixed definition for this. However, common practice in mathematical publications is:
This can be found here: math-SE, wolfram
Wikipedia also states, that additive notation is primarily used for modules and rings. However, that is quite obvious because for those you need both types of notations.
Interestingly, in cryptography we rarely see any non-abelian groups except matrix multiplication, yet multiplicative notation is quite common. The emphasis here might be on the difficulty of the discrete logarithm problem: If a group has the property, that calculating DLOG is difficult, we tend to use multiplicative notation. Additionally, we note generic groups in multiplicative notation mostly.
Additive notation is used mostly just for elliptic curves, or of it is actually a group operation derived from the addition of integers. In that case it might be used to emphasize: In this group the DLOG problem is easy.
For all efficient pairings we are aware of and actually use in cryptography, the groups $G_1$ and $G_2$ are elliptic curve groups (which are traditionally additively written, i.e., additive groups). However, as writing down protocols or schemes using multiplicative notation for groups is more compact and often more convenient to read, many people simply write $G_1$ and $G_2$ multiplicatively.
A group has an operation. We could call this operation by any name, since the name doesn't change what the operation is.
However, there is a convention when naming the operation: we often say that a group is additive (i.e., operation is the "addition") or multiplicative (i.e., its operation is the "multiplication").
The integers number equipped with the usual addition, that is $(\mathbb Z, +)$, form a group, which is obviously called an additive group. In the same way, any group that uses operations that we are already used to call "addition" are called additive groups (for instance, the set of $n \times n$ matrices equipped with the usual entry-wise addition). And groups derived from additive groups are also said to be additive groups (for instance, $\mathbb{Z} \times \mathbb{Z} \times \mathbb{Z}$).
Similarly, if a group uses a operation that we are already used to call by "multiplication", then we call it a multiplicative group. For instance, the set of rational numbers without the zero, that is $\mathbb{Q}^*$, is a multiplicative group (under the usual multiplication); the set of $n \times n$ invertible real matrices is a multiplicative group (under the usual matrix multiplication). And when a group is constructed by borrowing the multiplication of some set, we also call it a multiplicative group (e.g., think of $\mathbb{Z}_p^*$, for $p$ prime: we operate over its equivalence classes by multiplying the integers that represent such classes...).
Once you have said a group is additive or multiplicative, we will represent a single operation by $a+b$ or by $ab$, and a sequence of $n-1$ operations over a single element $a$ as $na$ or $a^n$, and the inverse element by $-a$ or $a^{-1}$, respectively.
Finally, there is also a preference to use additive notation when the operation is commutative and multiplicative notation otherwise. Note however that it is just a tendency. In several cases, commutative groups, like $\mathbb{Z}_p^*$ or elliptic curves, are represented multiplicatively.
Moreover, note that sometimes it is not clear how to name the group. For instance, for groups whose elements are functions and the operation is the composition of functions. When we compose two functions $f$ and $g$, obtaining $f \circ g $, we are not adding nor multiplying. Even so, a composition of the type $f \circ f$ is often denoted as $f^2$ instead of $2f$.
