# How is it decided if $G_1$ and $G_2$ are two “additive” or “multiplicative” cyclic groups?

According to wiki's definition of Bilinear pairing…

Let $G_1$ and $G_2$ be two additive cyclic groups of prime order $q$, and $G_T$ another cyclic group of order $q$ written multiplicatively. A pairing is a map: $e: G_1 \times G_2 \rightarrow G_T$ but, there also have different definition such that $G_1$ and $G_2$ be two multiplicative cyclic groups.

How is the decision made if $G_1$ and $G_2$ are two additive cyclic groups or multiplicative cyclic groups?

Notation is basically a free choice of the author, as they describe functionally the same. And there is no fixed definition for this. However, common practice in mathematical publications is:

• Multiplicative notation for arbitrary groups
• Additive notation for commutative groups

This can be found here: math-SE, wolfram

Wikipedia also states, that additive notation is primarily used for modules and rings. However, that is quite obvious because for those you need both types of notations.

Interestingly, in cryptography we rarely see any non-abelian groups except matrix multiplication, yet multiplicative notation is quite common. The emphasis here might be on the difficulty of the discrete logarithm problem: If a group has the property, that calculating DLOG is difficult, we tend to use multiplicative notation. Additionally, we note generic groups in multiplicative notation mostly.

Additive notation is used mostly just for elliptic curves, or of it is actually a group operation derived from the addition of integers. In that case it might be used to emphasize: In this group the DLOG problem is easy.

• There's probably also a historic note there: DLOG was traditionally (as the name implies) something multiplicative. While we nowadays typically instantiate new protocols using EC, papers are still written multiplicatively as was historically the case. I personally find them more difficult to read too, but that might be on me. – Ruben De Smet Jun 26 '19 at 7:39

For all efficient pairings we are aware of and actually use in cryptography, the groups $G_1$ and $G_2$ are elliptic curve groups (which are traditionally additively written, i.e., additive groups). However, as writing down protocols or schemes using multiplicative notation for groups is more compact and often more convenient to read, many people simply write $G_1$ and $G_2$ multiplicatively.

A group has an operation. We could call this operation by any name, since the name doesn't change what the operation is.

However, there is a convention when naming the operation: we often say that a group is additive (i.e., operation is the "addition") or multiplicative (i.e., its operation is the "multiplication").

The integers number equipped with the usual addition, that is $$(\mathbb Z, +)$$, form a group, which is obviously called an additive group. In the same way, any group that uses operations that we are already used to call "addition" are called additive groups (for instance, the set of $$n \times n$$ matrices equipped with the usual entry-wise addition). And groups derived from additive groups are also said to be additive groups (for instance, $$\mathbb{Z} \times \mathbb{Z} \times \mathbb{Z}$$).

Similarly, if a group uses a operation that we are already used to call by "multiplication", then we call it a multiplicative group. For instance, the set of rational numbers without the zero, that is $$\mathbb{Q}^*$$, is a multiplicative group (under the usual multiplication); the set of $$n \times n$$ invertible real matrices is a multiplicative group (under the usual matrix multiplication). And when a group is constructed by borrowing the multiplication of some set, we also call it a multiplicative group (e.g., think of $$\mathbb{Z}_p^*$$, for $$p$$ prime: we operate over its equivalence classes by multiplying the integers that represent such classes...).

Once you have said a group is additive or multiplicative, we will represent a single operation by $$a+b$$ or by $$ab$$, and a sequence of $$n-1$$ operations over a single element $$a$$ as $$na$$ or $$a^n$$, and the inverse element by $$-a$$ or $$a^{-1}$$, respectively.

Finally, there is also a preference to use additive notation when the operation is commutative and multiplicative notation otherwise. Note however that it is just a tendency. In several cases, commutative groups, like $$\mathbb{Z}_p^*$$ or elliptic curves, are represented multiplicatively.

Moreover, note that sometimes it is not clear how to name the group. For instance, for groups whose elements are functions and the operation is the composition of functions. When we compose two functions $$f$$ and $$g$$, obtaining $$f \circ g$$, we are not adding nor multiplying. Even so, a composition of the type $$f \circ f$$ is often denoted as $$f^2$$ instead of $$2f$$.

• Notation of exponents on function symbols has nothing to do with additive or multiplicative notations of groups. – tylo Sep 9 '16 at 11:05
• @tylo Arguably, they do since functions form a monoid under composition. What is missing from this answer, though, is that the additive notation is almost exclusively used for abelian groups. – Aleph Sep 9 '16 at 21:27
• @Aleph this is a good point (: – Hilder Vitor Lima Pereira Sep 11 '16 at 21:45
• @Aleph Well yes. But writing function composition with multiplicative notation is just another convention. Although I've never seen it, writing function composition in additive notation would also work. Unless a ring or field is involved, you can basically always exchange multiplicative notation with additive notation and vice versa. – tylo Sep 12 '16 at 9:17