(check detail information from here)

Let $(G_1,+)$, $(G_2,+)$ and $(G_T,.)$ are three cyclic groups of large prime order.

A map $\mathnormal{e} : G_1 \times G_2 \to G_T$ is a pairing map such that: $\mathnormal{e(g^x,g^y)=e(g,g)^{xy}=e(g,g^{xy})}$

Given $\mathnormal{g^x}$ and $\mathnormal{g^y}$, a pairing can check that some element $\mathnormal{h=g^{xy}}$ without knowing $\mathnormal{x}$ and $\mathnormal{y}$.

For the KZG commitment to work, we need a so-called trusted setup, consisting of a structured reference string (SRS). This will be a set of curve points in $G_1$ and $G_2$. For a field element $u \in \mathbb{F}_q$, define the notation $[u]_i\in G_i$ to be $[u]_i := u*g_i=g_i^u$. The SRS will consist of two sequences of group elements: $g_1^0, g_1^\tau,g_1^{\tau^2}, g_1^{\tau^3},\dots,g_1^{\tau^D} \in G_1$ $g_2^0, g_2^\tau,g_2^{\tau^2}, g_2^{\tau^3},\dots,g_2^{\tau^K} \in G_2$ where $\tau\in \mathbb{F}_q$ is a secret field element, not known by either participant. $g_1$ is the generator point of $G_1$ and $g_2$ is the generator point of $G_2$.

$D$ will be an upper bound for the degree of the polynomials we can commit, and $K$ will be sometimes just $K=1$.

Verify Operation

To verify an opening proof, the verifier would like to check the equation;

$q(x)(x-u) = f(x)-f(u)=f(x)-v$.

As the verifier does not have access to the actual polynomials $f$ and $q$, nor wants to spend precious time on these calculations ($D$ can be quite big!), the next best thing would be to check that

$com(q)\cdot(x-u) = com(f - v)$

Expanding the definition of $com$, we get;

$g_1^{q(\tau)(\tau-u)}=g_1^{f(\tau)-v}$

For elliptic curve notation this is equal to;

${q(\tau)(\tau-u)}*g_1={f(\tau)g_1-vg_1}$ Now we have a problem, namely, the multiplication on the left hand side. Here is the point where pairings come to the rescue! Pairings allow us to get away with one multiplication. So the what the verifier will actually check is;

$e( com(q) \;,\; ({\tau}g_2 - ug_2 )) = e( com(f) - v*g_1 \;,\; g_2 )$

i.e.

$e( q(\tau)*g_1 \;,\; ({\tau}g_2 - ug_2 )) = e( f(\tau)g_1 - vg_1 \;,\; g_2 )$

This works because of the bilinearity equation; $e( ag_1, bg_2) = e( g_1 , g_2 )^{ab}$