# Does the following equation hold in bilinear pairings?

$$e:G_1 \times G_1 \rightarrow G_2$$, where $$g$$ is a generator of $$G_1$$. $$\text{H}: \lbrace 0,1\rbrace ^* \rightarrow G_1$$.

Is $$e(\text{H}(D)g^a,g) == e(\text{H}(D)g,g)^a$$ ? where $$D$$ is a string

Does the following equation hold in bilinear pairings?

No, not in general.

$$g$$ is posited to be a generator, and so (for any fixed $$D$$), we have $$H(D) = g^b$$, for some integer $$b$$ (which is hard to compute, but we're not going to have to compute it).

So, we have $$e(H(D)g^a, g) = e(g^{a+b}, g)$$.

If we move the $$a$$ exponent out, we then get $$e(g^{1 + b/a}, g) = e( g \cdot g^{b/a}, g)^a$$

Doing the same thing one the other side, we would get $$e(H(D)g, g)^a = e(g \cdot g^b, g)^a$$

It should be clear that these two terms are not (in general) identical.

• $e(\text{H}(D)g^a,g) = e(\text{H}(D),g).e(g^a,g) = e(\text{H}(D),g).e(g,g)^a = e(\text{H}(D)g,g)^a$. Is this correct? Commented Feb 3, 2021 at 7:15
• @RabindraMoirangthem: how'd you get from $e(H(D), g) \cdot e(g,g)^a$ to $e(H(D)g, g)^a$? How did $H(D)$ get managed to be raised to the power of $a$? Commented Feb 3, 2021 at 12:50