BLS12_381G2HashToCurve (Bouncy Castle Library 1.85 API Specification)

java.lang.Object
- org.bouncycastle.crypto.bls.BLS12_381G2HashToCurve

```
public class BLS12_381G2HashToCurve
extends java.lang.Object
```
Implementation of the BLS12381G2_XMD:SHA-256_SSWU_RO_ hash-to-curve suite (RFC 9380 sec. 8.8.2): a deterministic, uniform map from a byte string and a domain-separation tag to a point in the BLS12-381 G2 prime-order subgroup.
Pipeline:
1. expand_message_xmd(msg, dst, 256) produces 256 bytes (count=2, m=2, L=64).
2. The bytes are split into two Fp^2 elements u[0], u[1].
3. Each is run through SSWU on the 3-isogenous helper curve E' (with A' = 240*I, B' = 1012*(1+I), Z = -(2+I)).
4. The results are mapped to E by the iso_3 rational map (RFC 9380 App. E.3).
5. The two G2 points are added, and the cofactor is cleared by scalar-multiplication by h_eff.

Constructor Summary

Constructors
Constructor Description

BLS12_381G2HashToCurve(byte[] dst)

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method	Description
`BLS12_381G2Point`	`hashToCurve(byte[] message)`
`Fp2Element[]`	`hashToField(byte[] message)`	Stage 1: expands `message` into two Fp² field elements per RFC 9380 sec. 5.3.
`BLS12_381G2Point`	`mapToCurveAndIso3(Fp2Element u)`	Stages 2-3: simplified SWU on E' followed by iso_3 to E.

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

- Constructor Detail
  - BLS12_381G2HashToCurve
```
public BLS12_381G2HashToCurve(byte[] dst)
```
- Method Detail
  - hashToCurve
```
public BLS12_381G2Point hashToCurve(byte[] message)
```
  - hashToField
```
public Fp2Element[] hashToField(byte[] message)
```
    Stage 1: expands message into two Fp² field elements per RFC 9380 sec. 5.3. Exposed for layered testing and for callers that want the raw field elements without the curve mapping.
  - mapToCurveAndIso3
```
public BLS12_381G2Point mapToCurveAndIso3(Fp2Element u)
```
    Stages 2-3: simplified SWU on E' followed by iso_3 to E. Exposed for layered testing; returns a point on E that has not yet had its cofactor cleared, so it is generally not in the prime-order subgroup.