G2 is the group of elliptic-curve points on an extension-field curve used as one input group for a pairing. Pairing constructions distinguish it from G1: tiny Tate tests select G1 or G2 points explicitly, while BLS multi-signatures place public keys and the generator g2 in G2. section 17.3 section 18.2.3
Use G2 in pairing workflows as follows:
- Select points whose group classification identifies them as G2 points; the test routine uses a type flag and accepts entries with a group value greater than one. section 17.3
- Respect the pairing's group ordering: tests with G1 × G2 succeed, whereas reversing the orders can fail; G2 × G2 is also tested for compatible inputs. section 17.3
- Use G2 for BLS public keys and g2, while signatures and the message hash lie in G1; aggregate verification compares pairings involving these groups. section 18.2.3
Tiny Tate-pairing test
For an 11×165 test, choose P in G1 and Q,T of order 165 in G2, compute τ(P,Q) and τ(P,T), then verify τ(P,Q)τ(P,T) = τ(P,T+Q). The displayed points use extension-field coordinates modulo 43. section 17.3
Listing 17.8 Tate 11x165 test
k = rndselect(grp, &point_list[1000], numxtdpnts[1], 0); #1
poly_point_copy(&S, xtndpnt[k]); #1
poly_point_printf(",order 5 S:\n", S); #1
printf(",===========================================\n");
printf(",Tate G1 x G2* (order 11x165)\n\n");
k = rndselect(grp, &point_list[2000], numxtdpnts[2], 0); #2
poly_point_copy(&P, xtndpnt[k]); #2
poly_point_printf(",P:\n", P); #2
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #3
poly_point_copy(&Q, xtndpnt[k]); #3
poly_point_printf(",Q:\n", Q); #3
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #4
poly_point_copy(&T, xtndpnt[k]); #4
poly_point_printf(",T:\n", T); #4
tate(&t1, P, Q, S, tor, Ex); #5
poly_printf(",tate(P, Q): ", t1);
tate(&t2, P, T, S, tor, Ex); #6
poly_printf(",tate(P, T): ", t2);
poly_mul(&t3, t1, t2); #7
poly_printf("(P, Q)*(P, T): ", t3); #8
poly_elptic_sum(&TpQ, T, Q, Ex); #9
tate(&t4, P, TpQ, S, tor, Ex); #10
poly_printf(",(P, T+Q): ", t4); #8
printf(",===========================================\n");
printf(",Tate G2 x G2* (order 11x165)\n\n");
k = rndselect(grp, &point_list[2000], numxtdpnts[2], 1); #11
poly_point_copy(&P, xtndpnt[k]); #11
poly_point_printf(",P:\n" P); #11
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #12
poly_point_copy(&Q, xtndpnt[k]); #12
poly_point_printf(",Q:\n", Q); #12
k = rndselect(grp, &point_list[6000], numxtdpnts[6], 1); #13
poly_point_copy(&T, xtndpnt[k]); #13
poly_point_printf(",T:\n", T); #13
tate(&t1, P, Q, S, tor, Ex); #5
poly_printf(",tate(P, Q): ", t1);
tate(&t2, P, T, S, tor, Ex); #6
poly_printf(",tate(P, T): ", t2);
poly_mul(&t3, t1, t2); #7
poly_printf(",(P, Q)*(P, T): ", t3); #8
poly_elptic_sum(&TpQ, T, Q, Ex); #9
tate(&t4, P, TpQ, S, tor, Ex); #10
poly_printf(",(P, T+Q): ", t4); #8
Browse the implementation flow for selecting G1 and G2 points, computing Tate pairings, multiplying results, and comparing them with the pairing of a point sum. section 17.3
