Pairings and hidden scalar proofs

Verify hidden scalar math by comparing public GT outputs.

A prover builds curve points from private scalars. The verifier applies a pairing and checks a target-group equality, without learning the scalars themselves.

Read blog

Proof patterns

What pairings let a verifier check

What prover wants to prove	Prover gives	Verifier checks	What it proves
I know secret a	`A = aP, then a challenge response`	`Checks the response against A`	Prover controls the scalar behind A, not just a copied point.
This signature was made by private key a	`signature = aH(m)`	`f(signature,Q) = f(H(m),aQ)`	Signature matches the public key.
Two public points use same secret a	`A = aP, B = aQ`	`f(A,Q) = f(P,B)`	Same scalar a links both points.
Two secrets multiply to ab	`A = aP, B = bQ`	`f(A,B) = f(P,Q)^(ab) indirectly`	The product is exposed in GT, not as raw scalars.
Aggregated signature is valid	`signature = signature1 + signature2 + signature3`	`Pairing equality with public keys`	Many signatures combined correctly.
Polynomial commitment opens correctly	`commitment + proof`	`Pairing equation`	Claimed polynomial value is correct.
zk-SNARK proof is valid	`proof points`	`Product of pairings equals target value`	Hidden computation satisfied constraints.

Interactive verifier

Same hidden scalar links two public points

Prove A and B were derived with the same hidden scalar a.

equation matches

message / statementA scalar a

B scalar b

Verifier lag timernot run

Elapsed 0.00s / simulated lag 0.00s

Prover gives

A in G1A = 17P

B in G2B = 17Q

Verifier checks

Left sidef(A,Q) = f(17P,Q)

Right sidef(P,B) = f(P,17Q)

Same-secret breakdown

Curve points go in. GT equality comes out.

The verifier is not comparing an elliptic-curve point to a target-group value. It applies the pairing to public curve points first, then compares two values in GT.

1. Hidden scalar layera = 17b = 17

A valid same-secret proof uses the same scalar on both public points. The second slider is named b so you can tamper with it and see the check fail.

2. Elliptic-curve layerA = 17P in G1B = 17Q in G2

A and B are curve points. The verifier can see them, but does not learn the scalar by looking at the point.

3. Pairing expansionf(A,Q) = f(17P,Q) = f(P,Q)^17f(P,B) = f(P,17Q) = f(P,Q)^17

Bilinearity moves the scalar from the curve input into the exponent of the same base target-group element.

4. Toy GT arithmeticleft exponent: 17 * 1 mod 101 = 17right exponent: 1 * 17 mod 101 = 17left GT: 64^17 mod 607 = 420right GT: 64^17 mod 607 = 420GT values match

Important distinction

A = aP alone is not a complete proof that someone knows a; someone could copy the public point. A real knowledge proof adds a challenge response or signature. This same-secret check proves that A and B are linked by the same hidden scalar.

Visible target-group values

Toy GT values on screen, real-world equation beside them

Real pairing systems output a large BLS12-381-style target-group element. This browser demo uses a tiny target group so the verifier result is inspectable.

left GTf(17P,Q)GT value 42064^17 mod 607

right GTf(P,17Q)GT value 42064^17 mod 607

Real-world pairing equationf(A,Q) = f(P,B)

Application

Cross-group public-key consistency checks and proof-system wiring.

What the verifier learns

A and B are linked by the same hidden scalar a without revealing a.

Target-group note

Both pairings equal the same target-group element.

Mental model

Prover builds points. Verifier compares GT outputs.

Prover does

Builds curve points using hidden scalars, then sends public points or proof points.

Verifier does

Applies pairings, multiplies target-group terms when needed, and checks equality.

Secret stays hidden

The verifier learns the algebraic relationship, not the raw scalar values.