Assume that we have a pairing as $e:G_1\times G_2\rightarrow G_T$. such that $g_1$ and $g_2$ are the generator of $G_1$ and $G_2$ respectively. In a protocol I have $A=\prod_{i=1}^n e(H(i),pk_i)$ where $H(i)\in G_1$ and its discrete-logarithm is unknown (since it is a random oracle) and $pk_i\in G_2$. I can design another protocol such that I can compute my target value $A$ in another way i.e., $A=e(H(l),\prod_i pk_i^{a_i})$ (where $H(l)\in G_1$ and independent of index $i$). The groups $G_1,G_2,G_3$ are the same in both schemes.
Thus the point which I am interested in is the efficiency. The main difference in these two evaluations is that:
In the first scheme we have $n$ pairing and $n$ multiplication over $G_T$. While in the second scheme, we have $n$ exponentiation over $G_2$ (exponents of $a_i$), $n$ multiplication in $G_2$ and 1 pairing.
Which of these schemes is more efficient? could you please give me some link and references for a precise comparison. Is the efficiency gain noticeable?
