Package org.bouncycastle.math.ec.sm9

Class SM9Curve

  • public class SM9Curve
extends java.lang.Object
    Fixed system parameters of the SM9 256-bit BN curve (GM/T 0044.5-2016, clause 1).

    Curve E: y^2 = x^3 + 5 over F_q. G1 is the prime-order subgroup of E(F_q) with generator P1; G2 is the subgroup of the sextic twist E'(F_p2): y^2 = x^3 + 5u with generator P2. The R-ate pairing e: G1 x G2 -> G_T uses loop parameter 6t+2.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static ECPoint g1FromBytes​(byte[] b, int off)
      Reconstruct a G1 point from its 64-byte x || y encoding.
      static byte[] g1ToBytes​(ECPoint p)
      Encode a G1 point as x || y (32 bytes each, big-endian), the affine-coordinate form SM9 concatenates into KDF/MAC inputs and ciphertexts (no 0x04 prefix).
      static ECPoint multiplySecure​(ECPoint p, java.math.BigInteger k)
      Constant-time G1 scalar multiplication for secret scalars, used for every SM9 scalar multiplication by private key material or an ephemeral secret (whether the base is the fixed generator P1 or a variable point such as a user's private-key point or a recipient point).

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • N

        public static final java.math.BigInteger N

      • G1

        public static final ECCurve G1

      • P1

        public static final ECPoint P1

    • Method Detail

      • g1ToBytes

        public static byte[] g1ToBytes​(ECPoint p)
        Encode a G1 point as x || y (32 bytes each, big-endian), the affine-coordinate form SM9 concatenates into KDF/MAC inputs and ciphertexts (no 0x04 prefix).

      • g1FromBytes

        public static ECPoint g1FromBytes​(byte[] b,
                                  int off)
        Reconstruct a G1 point from its 64-byte x || y encoding. The caller is responsible for validating the result (e.g. ECPoint.isValid()).

      • multiplySecure

        public static ECPoint multiplySecure​(ECPoint p,
                                     java.math.BigInteger k)
        Constant-time G1 scalar multiplication for secret scalars, used for every SM9 scalar multiplication by private key material or an ephemeral secret (whether the base is the fixed generator P1 or a variable point such as a user's private-key point or a recipient point). The comb runs a fixed number of steps and reads its precomputed table in constant time, so the number and pattern of point operations do not depend on the scalar - unlike the default windowed-NAF multiplier that ECPoint.multiply(java.math.BigInteger) would use.

        NOTE: G1 is backed by the fixed-limb Montgomery field SM9P256V1Field, so its field arithmetic is constant time; the residual variable-time cost is only the final conditional subtract / carry normalisation, as in BouncyCastle's other custom prime-field curves.