Pairing Algebra Cheat Sheet: From Curve Points to GT
A bilinear pairing is usually written as:
f: G1 x G2 -> GT
Many books use e instead of f. I will use f here because the cheat sheet is about the operation itself:
U_PQ = f(P, Q)
U_RQ = f(R, Q)
U_PS = f(P, S)
U_RS = f(R, S)
where:
P, R are points in G1
Q, S are points in G2
a, b, c, d are scalars
each U_* value is an element of GT
The mental model is simple:
point addition -> multiplication in GT
scalar multiplication -> exponentiation in GT
point subtraction -> division in GT
point negation -> inverse in GT
zero point -> identity in GT
Click a rule to see the elliptic-curve input and GT output.
The symbolic rule is the important part. The numeric panel uses a toy model where f(xP0, yQ0) = 64^(xy mod 101) mod 607, P = P0, R = rP0, Q = Q0, and S = sQ0.
Alias legend: U_PQ = f(P,Q), U_RQ = f(R,Q), U_PS = f(P,S), and U_RS = f(R,S).
Adding source points multiplies pairing outputs in GT.
Multiplying a source point by a scalar raises the GT result to that scalar.
Subtracting a source point divides by the matching pairing output.
Negating either source point inverts the GT output.
Pairing with the identity point lands on the identity in GT.
Add both slots
f(P + R, Q + S)U_PQ * U_PS * U_RQ * U_RSEvery term on the left pairs with every term on the right.
(5) * (7) mod 101 = 3564^35 mod 607 = 73571f(P,Q)6f(P,S)4f(R,Q)24f(R,S)The interactive uses a tiny toy target group so the output can be checked with numbers. The symbolic identities are the real lesson.
1. Point Addition -> GT Multiplication
This page uses target-group aliases instead of a single U. A single U usually means f(P,Q), but once the formula also contains f(R,Q), f(P,S), and f(R,S), the input pair needs to stay visible.
| Elliptic-curve input | GT output |
|---|---|
f(P+R,Q) | U_PQ * U_RQ |
f(P,Q+S) | U_PQ * U_PS |
f(aP+bP,Q) | U_PQ^(a+b) = U_PQ^a * U_PQ^b |
f(P,aQ+bQ) | U_PQ^(a+b) = U_PQ^a * U_PQ^b |
f(P+R,Q+S) | U_PQ * U_PS * U_RQ * U_RS |
where:
U_PQ = f(P,Q)
U_RQ = f(R,Q)
U_PS = f(P,S)
U_RS = f(R,S)
The important habit is to expand across the two slots. If the left slot has two terms and the right slot has two terms, every left term pairs with every right term.
2. Scalar Multiplication -> GT Exponentiation
| Elliptic-curve input | GT output |
|---|---|
f(aP,Q) | U_PQ^a |
f(P,bQ) | U_PQ^b |
f(aP,bQ) | U_PQ^(ab) |
f(aP+bR,cQ+dS) | U_PQ^(ac) * U_PS^(ad) * U_RQ^(bc) * U_RS^(bd) |
The last row is the pairing version of expanding:
(aP + bR)(cQ + dS)
but the result is not normal multiplication. It is a product of pairing outputs in GT.
3. Point Subtraction -> GT Division
| Elliptic-curve input | GT output |
|---|---|
f(P-R,Q) | U_PQ * U_RQ^-1 |
f(P,Q-S) | U_PQ * U_PS^-1 |
Subtraction is just addition with a negative point:
P - R = P + (-R)
That is why the matching GT term becomes an inverse.
4. Point Negation -> GT Inverse
| Elliptic-curve input | GT output |
|---|---|
f(-P,Q) | U_PQ^-1 |
f(P,-Q) | U_PQ^-1 |
Negating either source-group input flips the target-group output.
5. Zero Point -> GT Identity
| Elliptic-curve input | GT output |
|---|---|
f(0,Q) | 1_GT |
f(P,0) | 1_GT |
The zero point carries no source-group contribution, so the output is the identity element of GT.
Core Rule
The most useful line to remember is:
f(aP + bR, cQ + dS)
expands into:
U_PQ^(ac) * U_PS^(ad) * U_RQ^(bc) * U_RS^(bd)
That one formula contains the whole cheat sheet: addition distributes, scalars become exponents, and each left-side term pairs with each right-side term.
This is why pairings are useful in BLS signatures, KZG commitments, and zk-SNARK verifiers. They let a verifier move algebraic relationships between curve points into a single target-group calculation.