Package org.bouncycastle.crypto.bls

Class BLS12_381BasicScheme

  • public class BLS12_381BasicScheme
extends java.lang.Object
    BLS signatures BasicScheme over BLS12-381, per draft-irtf-cfrg-bls-signature (variant: public keys in G1, signatures in G2; suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_).

    Provides the algorithmic core: KeyGen, SkToPk, Sign, Verify, KeyValidate, and aggregate verification. The static API operates on in-memory math objects (BigInteger secret keys, ECPoint public keys, byte-array messages, BLS12_381G2Point signatures); BLS12_381Serialization converts to and from the spec's Zcash-format compressed encodings.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static byte[] DST
      Domain-separation tag for hash-to-curve under the BasicScheme suite.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static boolean aggregateVerify​(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg)
      Aggregate verification under the BasicScheme.
      static java.math.BigInteger keyGen​(byte[] ikm, byte[] keyInfo)
      Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.
      static boolean keyValidate​(ECPoint pk)
      Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.
      static BLS12_381G2Point sign​(java.math.BigInteger sk, byte[] message)
      Sign a message under the BasicScheme: sig = sk * H(message) where H is hash-to-G2 with the suite's DST.
      static ECPoint skToPk​(java.math.BigInteger sk)
      Derive the public key for a given secret key: PK = sk * G1_gen.
      static boolean verify​(ECPoint pk, byte[] message, BLS12_381G2Point signature)
      Verify a BasicScheme signature.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • DST

        public static final byte[] DST
        Domain-separation tag for hash-to-curve under the BasicScheme suite.

    • Method Detail

      • keyGen

        public static java.math.BigInteger keyGen​(byte[] ikm,
                                          byte[] keyInfo)
        Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.

        Same (ikm, keyInfo) input always produces the same secret key, so ikm should come from a high-entropy source the caller controls (e.g. SecureRandom.nextBytes).

        Parameters:
        ikm - input keying material; the spec requires at least 32 bytes.
        keyInfo - optional context binding; pass an empty array if not used.
        Returns:
        a secret key 0 < sk < r.

      • skToPk

        public static ECPoint skToPk​(java.math.BigInteger sk)
        Derive the public key for a given secret key: PK = sk * G1_gen.

      • keyValidate

        public static boolean keyValidate​(ECPoint pk)
        Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.

      • sign

        public static BLS12_381G2Point sign​(java.math.BigInteger sk,
                                    byte[] message)
        Sign a message under the BasicScheme: sig = sk * H(message) where H is hash-to-G2 with the suite's DST.

      • verify

        public static boolean verify​(ECPoint pk,
                             byte[] message,
                             BLS12_381G2Point signature)
        Verify a BasicScheme signature. Returns true iff pk is a valid G1 point in the prime-order subgroup, signature is a valid G2 point in the prime-order subgroup, and the pairing equation e(G1_gen, sig) == e(pk, H(message)) holds.

      • aggregateVerify

        public static boolean aggregateVerify​(ECPoint[] pks,
                                      byte[][] messages,
                                      BLS12_381G2Point sigAgg)
        Aggregate verification under the BasicScheme. Per draft-irtf-cfrg-bls-signature sec. 3.1.1, the messages must all be distinct — otherwise an attacker holding sk_1 and a victim public key pk_2 can forge an aggregate by setting sig_1 = sk_1*H(m), sig_2 arbitrary such that sig_1 + sig_2 cancels into a known value. The MessageAugmentation and ProofOfPossession suites avoid this requirement structurally; this BasicScheme variant enforces it.