Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \!\times\! \mathbb{G}_2 \to \mathbb{F}_{q^k}^*$ such that the number of additions in $\mathbb{G}_1$ is approximately equal to the number of additions in $\mathbb{G}_2$ during exection of these protocols?
As is well known, arithmetic in the group $\mathbb{G}_1$ is usually much less expensive than in $\mathbb{G}_2$, because the former is contained in the $\mathbb{F}_q$-point group $E(\mathbb{F}_q)$, but the latter lies in $E(\mathbb{F}_{q^k})$ or in $E^\prime(\mathbb{F}_{q^{k/d}})$ if the curve $E$ enjoys a twist $E^\prime$ of some degree $d \mid k$. Recall that $k = 12$ and $d = 6$ (and hence $k/d = 2$) is the most popular choice in practice today. That is why implementers of pairing-based cryptography deploy protocols in such a way that most additions are performed in $\mathbb{G}_1$ rather than in $\mathbb{G}_2$. For example, this is the case of the aggregate BLS signature including signature aggregation (i.e., multi-scalar multiplication) in $\mathbb{G}_1$.
I am wondering if there is a "symmetric" situation for which it is impossible to decrease the number of additions in $\mathbb{G}_2$ by means of the permutation $\mathbb{G}_1 \leftrightarrow \mathbb{G}_2$. I know how to significantly accelerate a protocol in the given setting by using a special pairing from the question, hence I need to justify my research work. Indeed, for that pairing, $\mathbb{G}_2$ is defined over a slightly smaller finite field than $\mathbb{F}_{q^{k/d}}$ at the cost of increasing overheads (for a number of reasons) in $\mathbb{G}_1$. Nevertheless, I estimated that these overheads turn out to be less essential than the performance gain due to reducing the basic field of $\mathbb{G}_2$. Thank you in advance for any of your comments!
