Package org.bouncycastle.crypto.bls

Class BLS12_381MessageAugmentation

  • public class BLS12_381MessageAugmentation
extends java.lang.Object
    BLS signatures MessageAugmentation suite over BLS12-381, per draft-irtf-cfrg-bls-signature: signature suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_AUG_.

    Differs from BLS12_381BasicScheme by prepending the public-key encoding to the message before hashing. The augmentation defends against rogue-key attacks in aggregate-verification without the standalone proof-of-possession step that BLS12_381ProofOfPossession requires.

    The public-key prefix used in the hash-to-curve input is the Zcash-format 48-byte compressed G1 encoding produced by BLS12_381Serialization.compressG1(org.bouncycastle.math.ec.ECPoint), matching draft-irtf-cfrg-bls-signature's point_to_pubkey so signatures are potentially interoperable with other BLS implementations once verified against published test vectors.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static byte[] DST  

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static boolean aggregateVerify​(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg)
      Aggregate verification under the MessageAugmentation suite.
      static BLS12_381G2Point sign​(java.math.BigInteger sk, byte[] message)
      Sign under the MessageAugmentation suite: sig = sk * H(SkToPk(sk) || message) with the AUG DST.
      static boolean verify​(ECPoint pk, byte[] message, BLS12_381G2Point signature)
      Verify under the MessageAugmentation suite.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • DST

        public static final byte[] DST

    • Method Detail

      • sign

        public static BLS12_381G2Point sign​(java.math.BigInteger sk,
                                    byte[] message)
        Sign under the MessageAugmentation suite: sig = sk * H(SkToPk(sk) || message) with the AUG DST.

      • verify

        public static boolean verify​(ECPoint pk,
                             byte[] message,
                             BLS12_381G2Point signature)
        Verify under the MessageAugmentation suite. Returns true iff pk is a valid prime-order G1 point, signature is a valid prime-order G2 point, and the pairing equation e(G1_gen, sig) == e(pk, H(pk || message)) holds.

      • aggregateVerify

        public static boolean aggregateVerify​(ECPoint[] pks,
                                      byte[][] messages,
                                      BLS12_381G2Point sigAgg)
        Aggregate verification under the MessageAugmentation suite. Distinct messages are not required: the augmentation makes each H(pk_i || msg_i) input unique even when the msg_i repeat.