It is an implementation of the bls12-381 algorithm known as pairing-friendly, at GitHub.

Looking at this, the pairing parameters are $G_1$ and $G_2$, $G_1$ is the point of $F_q$, $G_2$ is the point of $F_{q^2}$.

However, some papers describe it as follows.

Bilinear Map Let G1, G2 be two cyclic groups of prime modulo p. Let g be a primitive root (i.e. generator) of G1. A bilinear map [10] or bilinear pairing „e‟ is an effectively calculable task e : G1 × G1 → G2 such that it satisfies the below two conditions,

  1. Non degeneracy: e(g, g) ≠ 1.
  2. Bilinearity: e(gx, gy) = e(g, g)xy for all x, y ∈ Z.

Setup: Let E(Fq) be an elliptic curve above the fixed field Fq where q is large prime number (at least 160 bits) and G be a point on elliptic curve E of order n. Let G1, G2 be two multiplicative cyclic groups of prime modulo n. Let e : G1 × G1 → G2 be a bilinear map, z = e(G1, G1) ∈ G2.

$$z = e(G_1, G_1)$$

Here, both parameters take the point of $F_q$. How are they different?

  • $\begingroup$ Could you check the edits, also could you give a link for some papers? $\endgroup$
    – kelalaka
    Jul 16, 2020 at 13:23

1 Answer 1


The most general form of a bilinear map is $e : G_1 \times G_2 \to G_T$. We can categorize a scheme's usage of the bilinear map into 3 standard categories:

  • Type 1: in addition to the bilinear pairing, the scheme requires efficiently computable homomorphisms $\phi_{12} : G_1 \to G_2$ and $\phi_{21} : G_2 \to G_1$. In other words, the scheme sometimes needs to "convert/cast" a $G_1$-element to a $G_2$-element and vice-versa. This is the same thing as requiring that $G_1 = G_2$.

  • Type 2: the scheme requires an efficient homomorphism $\phi_{12} : G_1 \to G_2$. In other words, the scheme sometimes needs to "convert/cast" a $G_1$-element into a $G_2$-element (but not vice-versa).

  • Type 3: the scheme never needs to "convert/cast" between groups.

See Pairings for Cryptographers by Galbraith, Paterson, and Smart for more discussion about these types (especially section 2).

Type 3 is the most desirable since it places the fewest restrictions on the bilinear map. Type 1 demands a lot of structure from the bilinear map, and I think type-1-compatible groups/pairings are less efficient.

  • $\begingroup$ Thanks you so much! In summary, should z = e (G1, G1) be bilinear pairing of Type-1? $\endgroup$
    – user212942
    Jul 16, 2020 at 9:33
  • $\begingroup$ Probably yes. But another possibility is that Type 1 is the easiest for a designer to think about. So perhaps the scheme's designer figured out something that worked in Type 1 and didn't bother to check whether all the Type 1 homomorphisms are actually necessary... (I would probably be guilty of this) $\endgroup$
    – Mikero
    Jul 16, 2020 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.