A bilinear pairing is a cryptographic tool that moves elements from two groups into another group, where their hidden exponents can interact multiplicatively. In plain terms, it lets a verifier multiply values that ordinary homomorphic commitments can only add or scale. section 15.3.3 section 15.3.2
The essential behavior is captured by a pairing written as e:
- e(g₁, g₂) = h₃ maps generators from two groups into a third group. section 15.3.3
- In the symmetric example, e(gᵇ, gᶜ) = e(g)ᵇᶜ, exposing the product of hidden exponents without exposing the exponents themselves. section 15.3.3
- This extends homomorphic commitments from addition and public scaling to one multiplication; it is not fully homomorphic. section 15.3.2 section 15.3.3
Checking a hidden polynomial relation
A zk-SNARK can hide polynomial evaluations in group exponents. A verifier combines hidden terms and uses a pairing to check a relation such as e(gᵃᴸ¹(r), g⁽ᵇ⁺³⁾ᴿ¹(r)) − e(g, gᵐᴼ¹(r)), while the evaluation point r remains unknown. This is a simplified demonstration: additional mechanisms are needed to constrain the prover and complete a real protocol. section 15.3.9 section 15.3.3
