Pairing papers state the optimal ate pairing symbolically and stop. This page runs it, on scalars you choose, and prints every number it touches — the slope of each chord, the modular inverse behind it, the three non-zero coefficients of every line function, all sixty-four Miller iterations, and the whole final exponentiation. It is a procedural reference for someone who has to implement e(P, Q) on BN254 and has discovered that the literature never shows the arithmetic.
Scope. Three derivations, from generators to pairing value, with nothing elided: [a]G1 over the base field, [b]G2 over the quadratic extension, and e(P, Q) in the twelfth-degree extension. Both scalars are yours to supply — any integers in [1, r−1], decimal or hex.
Everything is computed in the browser in BigInt arithmetic from the single Barreto–Naehrig parameter x. The moduli, the twist constant, the Frobenius constants, the loop parameter and the 761-bit final-exponentiation exponent are all derived at load time rather than pasted in.
It wants 1024 × 560 logical pixels or more. The step, the numbers it produced, and which field each of those numbers lives in are meant to be read together; on anything smaller the page offers this write-up instead.
| Routine | Works in | What you see |
|---|---|---|
| [a]·G1 | Fp | Left-to-right double-and-add in affine coordinates. Every step shows λ, the extended-Euclid inverse that produced it, the new coordinates, and an on-curve check. The scalar's bit decomposition sits beside the ladder, set bits marked, each cell a link to the step that consumes it. |
| [b]·G2 | Fp2 | The same algorithm on the sextic twist. Every operation opens into the Fp arithmetic underneath it — the four products of a complex multiply, the norm and single base-field inverse behind an inversion, the componentwise nature of addition. |
| e(P, Q) | Fp12 | 112 steps: 64 Miller iterations, the two Frobenius corrections, the Miller value, then the easy and hard halves of the final exponentiation. The full twelve-coordinate accumulator is on screen throughout, and every Fp12 operation can be followed down to base-field multiplications. |
The confusion this page is built to remove has a panel of its own, always on screen. a and b are elements of the scalar field Fr. P is a point with two coordinates in the base field Fp. Q is a point on the twist, four Fp elements. And e(P, Q) is none of those things.
GT is not a curve and has no points. It is μr, the r-th roots of unity inside the multiplicative group of Fp12 — a subgroup of a field, whose operation is multiplication and whose identity is 1. A GT element is one field element, printed here as its twelve Fp coordinates. That is not pedantry: it is why GT is attacked by index calculus rather than by generic square-root methods, and why BN254's security estimate fell from 128 bits to roughly 100 after the extended tower number field sieve.
p and r are both 254 bits and agree in their top 61 bits — they differ only by 6x2. Substituting one for the other is the single most common BN254 bug, and it survives small tests.
Nearly every account of pairings assumes you already know how to multiply in
Fp12. Almost nobody writes the formula down.
On this page every operation in an extension field is a dropdown: open it and you get the
identity being applied and the numbers it produced, and you can keep opening until you reach
base-field multiplications.
- Addition is componentwise. It never mixes components — it is base-field addition done twice, or twelve times. Worth seeing once so it stops being mysterious.
- Multiplication is polynomial convolution plus one folding rule. Multiply out
as polynomials, then fold anything above the top degree back down:
u2 = −1inFp2,w6 = ξinFp12. That fold is the entire content of the extension. AnFp12product opens into its sixw-coefficients, each of which says which terms wrapped around and picked up a factor ofξ; each of those opens into theFp2products, and each of those into fourFpmultiplications. - Inversion drops a level. Multiply by the conjugate to land in a smaller
field, invert there, multiply back. Nothing is ever inverted at the top of the tower —
the only true inversion anywhere on the page is a single one in
Fp, by extended Euclid. - Frobenius is not an exponentiation. Raising to the
p-th power conjugates each coefficient and scales it by a constant — six multiplications, no ladder. The page shows theγconstants it used.
A Miller iteration multiplies the accumulator by a line through two points on the curve, evaluated at P. Papers write ℓT,T(P) and move on. Untwisted through the D-type map ψ(x, y) = (x·w2, y·w3), that line collapses to three terms:
ℓ0 = yP— which is inFp, not merelyFp2ℓ1 = −λ·xPℓ3 = λ·xT − yT
The other three coefficients are zero, which is the whole reason the multiply costs eighteen Fp2 products instead of thirty-six. The page prints all three coefficients at every one of the hundred line steps, and expands the sparse multiplication into the six output coefficients it actually computes.
The two Frobenius corrections at the end are shown for what they are: 6x+2 is too short on its own, and rather than pay for [p]Q, the p-power Frobenius does the same job as a conjugation and two constant multiplications. The page verifies π(Q) = [p]Q against a real scalar multiplication rather than asserting it.
The Miller value is not the pairing, and the page says so on its own step: it depends on which representative of the Miller function was used, so two correct implementations can legitimately disagree there. Raising it to (p12−1)/r is what makes the answer canonical.
That exponent factors as (p6−1)(p2+1)·d. The easy part costs one conjugation, one inversion and one Frobenius — and lands the accumulator in the cyclotomic subgroup, after which inversion is conjugation and every negative exponent in the hard part becomes a sign flip. The hard part's d is 761 bits, so it is written in base p, turning three of the four terms into Frobenius maps and leaving exponents of 192, 192 and 127 bits. The page checks that decomposition twice: once as an exact integer identity, and once by comparing against a direct 761-bit exponentiation of the same input.
Correctness here is the entire product, so it was established before the page shipped rather than asserted afterwards.
- Differentially tested against
py_ecc, the Ethereum Foundation's reference implementation for this curve, across seventeen scalar pairs including1,r−1and random 254-bit values. Both scalar multiplications and the full pairing match exactly, after the change of basis betweenpy_ecc's flat degree-12 representation and the tower used here. - A second, independent reference was written from the specification and agrees with both.
- Every step carries its own assertion — on-curve checks after each point operation,
d·d−1 ≡ 1after each inversion. Nearly nineteen thousand of them were evaluated across the test matrix, all passing. - A 25-check self-test runs in your browser, from the spec sheet. It re-derives the moduli from
x, confirmsξ = 9 + uis neither a square nor a cube, checks the embedding degree is exactly 12, verifies the Frobenius shortcut against direct exponentiation, and confirms bilinearity for the scalars currently on screen. The G2 cofactor is not assumed: the page constructs a point on the twist outside ther-torsion and shows it is annihilated byr·(2p−r).
It is a derivation reference, not a library, and the spec sheet says where the two part ways. Affine coordinates mean a real modular inversion at every step, which is exactly what production code restructures to avoid. The loops are plain binary rather than NAF. Squaring in the cyclotomic subgroup uses the generic formula. Inputs are constructed by scalar multiplication of the generators, so subgroup checks are unnecessary here — and mandatory anywhere points arrive from outside, because the G2 cofactor is not 1.