← Hall of Foundations Exhibit 156 · e(aP,bQ)=e(P,Q)ᵃᵇ
A Tool Used by Some zk-SNARKs

Multiplying the
unmultipliable

On an elliptic curve you can add points, but you cannot multiply two of them together — and the discrete log keeps their secret scalars hidden. A pairing is a strange, powerful function that reaches across two points and checks a multiplicative relationship between those hidden scalars, without ever revealing them.

A model of one identity. This page illustrates bilinearity with small modular powers. It neither hides its inputs nor implements a pairing or privacy protocol.
§1

A bridge between two worlds

A bilinear pairing e takes two points from elliptic-curve groups and maps them into a finite field, in a way that turns point-scaling into exponentiation. Scale the inputs by hidden scalars a and b, and the output is the base pairing raised to the product a·b.

e(aP, bQ) = e(P, Q)a·b

That's the entire superpower. The scalars a and b stay locked behind the discrete log on the curve, but the pairing lets anyone verify that the multiplication a·b happened — blindly.

§2

Explore the bilinearity identity

This interaction is an exponent model of bilinearity. It compares (5ᵃ)ᵇ mod 23 with 5ᵃᵇ mod 23 using the displayed scalars. It does not compute elliptic-curve points, a real pairing, or a zero-knowledge proof. The symbolic labels show where those objects occur in the actual pairing identity.

—
Both paths compute the same tiny modular exponentiation. This checks an exponent identity; the displayed P, Q and e(P,Q) are symbolic stand-ins, not calculated elliptic-curve points or pairing values.
Keyboard alternative: set scalars a and b, then evaluate both paths.
§3

How proof systems use pairings

Pairings enable compact verification in systems such as Groth16 and appear in KZG polynomial commitments. BLS signature aggregation is another application, but is not itself a zk-SNARK. Zero knowledge requires additional protocol structure and randomization; bilinearity or a polynomial commitment alone does not provide it.

A pairing checks an algebraic relationship. The surrounding protocol must supply soundness, zero knowledge and any required setup guarantees.

Pairings power several of the most influential and compact proof systems, but they are one major family rather than a requirement for succinctness. STARKs verify with hashes and no pairing at all; Bulletproofs and Halo-style systems get short proofs and recursion from ordinary discrete-log groups. The distinction matters here more than most places in this hall: pairing-friendly curves rest on the discrete log, so a quantum computer takes them with everything else in §143's lineage — while hash-based STARKs are expected to survive. Succinct verification has more than one foundation, and they don't share a fate.

Where this touches your keys

Under the privacy protocols

Some zk-SNARKs, identity-based encryption constructions and signature schemes use pairings. The target is typically a multiplicative subgroup of an extension field. The required security assumptions and parameter choices concern both source and target groups; a pairing is an algebraic tool, not an independent promise of privacy.

Applied in: Zero-Knowledge Proofs — where the pairing-based zk-SNARK family puts this identity to work.
Builds on: Elliptic Curves, Group Theory. Exponent identity tested in crypto-algebra.js.

Sources and scope: Groth, On the Size of Pairing-based Non-interactive Arguments (2016); Boneh, Lynn and Shacham, Short Signatures from the Weil Pairing (2001).