G1 is the elliptic-curve group used as the first input to a pairing written G1 × G2. Its role is determined by the pairing construction: points selected from G1 are paired with points from G2 or a related subgroup. section 17.3 section 18.2.3
G1 appears operationally in two pairing workflows:
- Supports Tate-pairing tests by selecting a point from the designated G1 subgroup and combining it with G2 points; the implementation records points by order and group type. section 17.3
- Carries BLS signatures and the hashed message point, while public keys and the generator g2 remain in G2 for Weil-pairing verification. section 18.2.3
- Uses pairing bilinearity to relate operations in G1 and G2; aggregating G1 signatures produces a single point used in the verification equation. section 18.2.3
Tiny Tate test
A test selects P from the order-11 G1 column and Q and T from the order-165 G2 column, then checks τ(P,T+Q) = τ(P,T)τ(P,Q). The displayed runs show matching results. section 17.3
Listing 17.8 Tate 11x165 test
k = rndselect(grp, &point_list[1000], numxtdpnts[1], 0); #1
poly_point_copy(&S, xtndpnt[k]); #1
poly_point_printf(",order 5 S:\n", S); #1
printf(",===========================================\n");
printf(",Tate G1 x G2* (order 11x165)\n\n");
k = rndselect(grp, &point_list[2000], numxtdpnts[2], 0); #2
poly_point_copy(&P, xtndpnt[k]); #2
poly_point_printf(",P:\n", P); #2
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #3
poly_point_copy(&Q, xtndpnt[k]); #3
poly_point_printf(",Q:\n", Q); #3
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #4
poly_point_copy(&T, xtndpnt[k]); #4
poly_point_printf(",T:\n", T); #4
tate(&t1, P, Q, S, tor, Ex); #5
poly_printf(",tate(P, Q): ", t1);
tate(&t2, P, T, S, tor, Ex); #6
poly_printf(",tate(P, T): ", t2);
poly_mul(&t3, t1, t2); #7
poly_printf("(P, Q)*(P, T): ", t3); #8
poly_elptic_sum(&TpQ, T, Q, Ex); #9
tate(&t4, P, TpQ, S, tor, Ex); #10
poly_printf(",(P, T+Q): ", t4); #8
printf(",===========================================\n");
printf(",Tate G2 x G2* (order 11x165)\n\n");
k = rndselect(grp, &point_list[2000], numxtdpnts[2], 1); #11
poly_point_copy(&P, xtndpnt[k]); #11
poly_point_printf(",P:\n" P); #11
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #12
poly_point_copy(&Q, xtndpnt[k]); #12
poly_point_printf(",Q:\n", Q); #12
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #13
poly_point_copy(&T, xtndpnt[k]); #13
poly_point_printf(",T:\n", T); #13
tate(&t1, P, Q, S, tor, Ex); #5
poly_printf(",tate(P, Q): ", t1);
tate(&t2, P, T, S, tor, Ex); #6
poly_printf(",tate(P, T): ", t2);
poly_mul(&t3, t1, t2); #7
poly_printf(",(P, Q)*(P, T): ", t3); #8
poly_elptic_sum(&TpQ, T, Q, Ex); #9
tate(&t4, P, TpQ, S, tor, Ex); #10
poly_printf(",(P, T+Q): ", t4); #8
Trace the concrete Tate test from subgroup-specific random selection through pairing evaluation and multiplication of the two pairing outputs. section 17.3
