Pairing papers state the optimal ate pairing symbolically and stop. This page runs it, on scalars you choose, and prints every number it touches — the slope of each chord, the modular inverse behind it, the coefficients of every line function, all sixty-four Miller iterations, and the whole final exponentiation. It is a procedural reference for someone who has to implement e(P, Q) on BN254 and has discovered that the literature never shows the arithmetic.
Scope. Three derivations, from generators to pairing value, with nothing elided. Both scalars are yours to supply — any integers in [1, r−1], decimal or hex. Everything is computed in the browser in BigInt arithmetic from the single Barreto–Naehrig parameter x; the moduli, the twist constant, the Frobenius constants and the final-exponentiation exponent are derived at load time rather than pasted in.
| Routine | Works in | What you see |
|---|---|---|
| [a]·G1 | Fp | Left-to-right double-and-add in affine coordinates: every λ, the extended-Euclid inverse that produced it, the new coordinates, and an on-curve check. |
| [b]·G2 | Fp2 | The same algorithm on the sextic twist, with every operation opening into the Fp arithmetic underneath it. |
| e(P, Q) | Fp12 | 112 steps: 64 Miller iterations, the two Frobenius corrections, the Miller value, then the easy and hard halves of the final exponentiation, with the full twelve-coordinate accumulator on screen throughout. |
a and b live in the scalar field Fr; P is a point with coordinates in the base field Fp; Q is a point on the twist. GT is not a curve and has no points. It is μr, the r-th roots of unity inside Fp12: a subgroup of a field, which is why it is attacked by index calculus and why BN254's security estimate fell from 128 bits to roughly 100. And p and r agree in their top 61 bits: substituting one for the other is the most common BN254 bug, and it survives small tests.
Every operation in an extension field is a dropdown that opens into the identity applied and the numbers it produced, down to base-field multiplications.
- Multiplication is polynomial convolution plus one folding rule:
u2 = −1inFp2,w6 = ξinFp12. That fold is the entire content of the extension. - Inversion drops a level. Multiply by the conjugate, invert in the smaller field,
multiply back: an
Fp12inversion bottoms out in a singleFpinversion, by extended Euclid. - Frobenius is not an exponentiation. Raising to the
p-th power conjugates each coefficient and scales it by a constant: six multiplications, no ladder.
Untwisted through the D-type map ψ(x, y) = (x·w2, y·w3), the Miller line collapses to three non-zero terms: ℓ0 = yP, ℓ1 = −λ·xP and ℓ3 = λ·xT − yT. The other three are zero, which is why the multiply costs eighteen Fp2 products instead of thirty-six. The page prints all three at every one of the hundred line steps, and verifies π(Q) = [p]Q for the Frobenius corrections against a real scalar multiplication.
The Miller value is not the pairing: two correct implementations can legitimately disagree there, and raising it to (p12−1)/r makes the answer canonical. The easy part lands the accumulator in the cyclotomic subgroup, where inversion is conjugation. The hard part's 761-bit exponent is written in base p, and the page checks that decomposition both as an exact integer identity and against a direct 761-bit exponentiation.
- Differentially tested against
py_ecc, the Ethereum Foundation's reference implementation, across seventeen scalar pairs: both scalar multiplications and the full pairing match exactly. - Every step carries its own assertion; nearly nineteen thousand were evaluated across the test matrix, all passing.
- A 25-check self-test runs in your browser, including bilinearity for the scalars on screen. The G2 cofactor is not assumed: a point outside the
r-torsion is shown to be annihilated byr·(2p−r).
It is a derivation reference, not a library: affine coordinates, plain binary loops and generic cyclotomic squaring, where production code would replace all three. Inputs come from the generators, so subgroup checks are unnecessary here — and mandatory anywhere points arrive from outside.