Bilinearity means a pairing is linear in each point argument: adding points in the elliptic-curve domain becomes multiplying their pairings in the field-valued output. This converts additive point operations into multiplicative field operations, a capability used in cryptographic pairing constructions. section 15.1 section 15.1.1
For points R, S, and T of order m, the operational rules are:
- eₘ(R + S, T) = eₘ(R,T)eₘ(S,T), and eₘ(R, S + T) = eₘ(R,S)eₘ(R,T). section 15.1.1
- Scaling both arguments gives eₘ(aS, bT) = eₘ(S,T)ᵃᵇ. section 15.1.1
- Negating either argument inverts the result: eₘ(−S,T) = eₘ(S,−T) = eₘ(S,T)⁻¹. section 15.1.1
Combining scaled points
For integers a, b, and c, bilinearity expands a combined input as eₘ(aR + bS, cT) = [eₘ(R,T)ᵃ eₘ(S,T)ᵇ]ᶜ. The left side performs point addition and scalar multiplication; the right side performs field multiplication and exponentiation. section 15.1.1
Equation 15.2
\[\begin{gathered} e_m(R+S, T)=e_m(R,T) e_m(S,T)\\ e_m(R, S+T) = e_m(R, S) e_m(R,T) \end{gathered} \label{pg1}\]Displays the two defining identities, one linearity rule for each pairing argument. section 15.1.1
