← Hall of Foundations Exhibit 156 · e(aP,bQ)=e(P,Q)ᵃᵇ
The Magic Behind zk-SNARKs

Multiplying the
unmultipliable

On an elliptic curve you can add points, but you cannot multiply two of them together — and the discrete log keeps their secret scalars hidden. A pairing is a strange, powerful function that reaches across two points and checks a multiplicative relationship between those hidden scalars, without ever revealing them.

Advanced, and worth it. This is the deepest exhibit in the hall. The takeaway is one identity: a pairing lets a verifier confirm that hidden numbers multiply correctly — the exact power that makes succinct zero-knowledge proofs and identity-based encryption possible.
§1

A bridge between two worlds

A bilinear pairing e takes two points from elliptic-curve groups and maps them into a finite field, in a way that turns point-scaling into exponentiation. Scale the inputs by hidden scalars a and b, and the output is the base pairing raised to the product a·b.

e(aP, bQ) = e(P, Q)a·b

That's the entire superpower. The scalars a and b stay locked behind the discrete log on the curve, but the pairing lets anyone verify that the multiplication a·b happened — blindly.

§2

Verify a product you can't see

Set the two secret scalars a and b. On the curve side, all a verifier sees are the scaled points aP and bQ — the scalars themselves are hidden. Yet feeding those points through the pairing lands on the same field value as taking the base pairing to the power a·b. Watch the two paths meet.

—
Left path scales the points on the curve, then pairs. Right path pairs first, then exponentiates by a·b. Both land on the same field element — that equality is bilinearity. (Values use a toy group so the arithmetic stays small.)
Keyboard alternative: set scalars a and b, then evaluate both paths.
§3

Why this unlocks zero-knowledge

A zk-SNARK proves a statement is true while revealing nothing but the proof's validity. In the pairing-based family — Groth16 above all, plus the KZG-committed systems and BLS signature aggregation — the final check is a pairing equation: the verifier confirms that certain hidden values satisfy a multiplicative relationship, that the prover's secret witness makes the circuit's equations balance, using exactly the identity above.

The discrete log hides the numbers; the pairing checks their product. That is the seam where zero-knowledge lives.

Pairings power several of the most influential and compact proof systems, but they are one major family rather than a requirement for succinctness. STARKs verify with hashes and no pairing at all; Bulletproofs and Halo-style systems get short proofs and recursion from ordinary discrete-log groups. The distinction matters here more than most places in this hall: pairing-friendly curves rest on the discrete log, so a quantum computer takes them with everything else in §143's lineage — while hash-based STARKs are expected to survive. Succinct verification has more than one foundation, and they don't share a fate.

Where this touches your keys

Under the privacy protocols

Pairings extend the elliptic-curve exhibits into the privacy-preserving landscape: zk-SNARK proof systems rest on pairing-based verification, and identity-based encryption schemes use the same e(aP,bQ) identity to derive keys from names. Where the curve gave you a hard discrete log, the pairing gives you a way to compute across it without breaking it.

Applied in: Zero-Knowledge Proofs — where the pairing-based zk-SNARK family puts this identity to work.
Builds on: Elliptic Curves, Group Theory. Bilinearity identity tested in crypto-algebra.js.