# What is different between G1×G1→GT and G1×G2→GT in the bilinear pairing?

It is an implementation of the bls12-381 algorithm known as pairing-friendly, at GitHub.

Looking at this, the pairing parameters are $$G_1$$ and $$G_2$$, $$G_1$$ is the point of $$F_q$$, $$G_2$$ is the point of $$F_{q^2}$$.

However, some papers describe it as follows.

Bilinear Map Let G1, G2 be two cyclic groups of prime modulo p. Let g be a primitive root (i.e. generator) of G1. A bilinear map [10] or bilinear pairing „e‟ is an effectively calculable task e : G1 × G1 → G2 such that it satisfies the below two conditions,

1. Non degeneracy: e(g, g) ≠ 1.
2. Bilinearity: e(gx, gy) = e(g, g)xy for all x, y ∈ Z.

Setup: Let E(Fq) be an elliptic curve above the fixed field Fq where q is large prime number (at least 160 bits) and G be a point on elliptic curve E of order n. Let G1, G2 be two multiplicative cyclic groups of prime modulo n. Let e : G1 × G1 → G2 be a bilinear map, z = e(G1, G1) ∈ G2.

$$z = e(G_1, G_1)$$

Here, both parameters take the point of $$F_q$$. How are they different?

• Could you check the edits, also could you give a link for some papers? – kelalaka Jul 16 '20 at 13:23

The most general form of a bilinear map is $$e : G_1 \times G_2 \to G_T$$. We can categorize a scheme's usage of the bilinear map into 3 standard categories:

• Type 1: in addition to the bilinear pairing, the scheme requires efficiently computable homomorphisms $$\phi_{12} : G_1 \to G_2$$ and $$\phi_{21} : G_2 \to G_1$$. In other words, the scheme sometimes needs to "convert/cast" a $$G_1$$-element to a $$G_2$$-element and vice-versa. This is the same thing as requiring that $$G_1 = G_2$$.

• Type 2: the scheme requires an efficient homomorphism $$\phi_{12} : G_1 \to G_2$$. In other words, the scheme sometimes needs to "convert/cast" a $$G_1$$-element into a $$G_2$$-element (but not vice-versa).

• Type 3: the scheme never needs to "convert/cast" between groups.

See Pairings for Cryptographers by Galbraith, Paterson, and Smart for more discussion about these types (especially section 2).

Type 3 is the most desirable since it places the fewest restrictions on the bilinear map. Type 1 demands a lot of structure from the bilinear map, and I think type-1-compatible groups/pairings are less efficient.

• Thanks you so much! In summary, should z = e (G1, G1) be bilinear pairing of Type-1? – user212942 Jul 16 '20 at 9:33
• Probably yes. But another possibility is that Type 1 is the easiest for a designer to think about. So perhaps the scheme's designer figured out something that worked in Type 1 and didn't bother to check whether all the Type 1 homomorphisms are actually necessary... (I would probably be guilty of this) – Mikero Jul 16 '20 at 15:52