$e:G_1 \times G_1 \rightarrow G_2$, where $g$ is a generator of $G_1$. $\text{H}: \lbrace 0,1\rbrace ^* \rightarrow G_1$.

Is $e(\text{H}(D)g^a,g) == e(\text{H}(D)g,g)^a$ ? where $D$ is a string


1 Answer 1


Does the following equation hold in bilinear pairings?

No, not in general.

$g$ is posited to be a generator, and so (for any fixed $D$), we have $H(D) = g^b$, for some integer $b$ (which is hard to compute, but we're not going to have to compute it).

So, we have $e(H(D)g^a, g) = e(g^{a+b}, g)$.

If we move the $a$ exponent out, we then get $e(g^{1 + b/a}, g) = e( g \cdot g^{b/a}, g)^a$

Doing the same thing one the other side, we would get $e(H(D)g, g)^a = e(g \cdot g^b, g)^a$

It should be clear that these two terms are not (in general) identical.

  • $\begingroup$ $e(\text{H}(D)g^a,g) = e(\text{H}(D),g).e(g^a,g) = e(\text{H}(D),g).e(g,g)^a = e(\text{H}(D)g,g)^a$. Is this correct? $\endgroup$ Commented Feb 3, 2021 at 7:15
  • $\begingroup$ @RabindraMoirangthem: how'd you get from $e(H(D), g) \cdot e(g,g)^a$ to $e(H(D)g, g)^a$? How did $H(D)$ get managed to be raised to the power of $a$? $\endgroup$
    – poncho
    Commented Feb 3, 2021 at 12:50
  • $\begingroup$ crypto.stackexchange.com/questions/19653/… what about this one? $\endgroup$ Commented Feb 4, 2021 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.