Package org.bouncycastle.math.ec.sm9

Class SM9G2Point

  • public class SM9G2Point
extends java.lang.Object
    Affine point of the group G2 for SM9: the sextic twist E'(F_p2): y^2 = x^3 + 5u (GM/T 0044.5-2016). Immutable. G1 by contrast is an ordinary prime-field curve handled by ECCurve.Fp.

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      SM9G2Point add​(SM9G2Point o)  
      static SM9G2Point decode​(byte[] enc)  
      boolean equals​(java.lang.Object other)  
      byte[] getEncoded()
      Uncompressed encoding 0x04 || x || y, each F_p2 coordinate written high dimension first (u-coefficient then constant), 32 bytes per F_p component; 129 bytes total.
      int hashCode()  
      boolean isInfinity()  
      SM9G2Point multiply​(java.math.BigInteger k)
      Scalar multiplication by a Montgomery ladder, maintaining the invariant r1 = r0 + this and returning [k]this.

      • Methods inherited from class java.lang.Object

        clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

    • Method Detail

      • isInfinity

        public boolean isInfinity()

      • multiply

        public SM9G2Point multiply​(java.math.BigInteger k)
        Scalar multiplication by a Montgomery ladder, maintaining the invariant r1 = r0 + this and returning [k]this. The loop runs a fixed, scalar-independent number of iterations (the group order bit length) doing exactly one point addition and one doubling per bit, so it removes the Hamming-weight and bit-length leaks of the plain double-and-add it replaces.

        NOTE: this is a hardening, not a full constant-time guarantee. The per-bit if/else selects which running point is updated (a data-dependent branch), the INFINITY fast paths in add(org.bouncycastle.math.ec.sm9.SM9G2Point)/twice() make the leading-zero prefix of the scalar cheaper (leaking its most-significant-bit position), and the underlying F_p2 arithmetic is BigInteger-based and not itself constant time. It is used only for the two secret scalars in offline KGC key derivation ([ks]P2 and [t2]P2); a fully constant-time G2 would need a uniform, sentinel-free point representation over a fixed-limb F_p2.

      • getEncoded

        public byte[] getEncoded()
        Uncompressed encoding 0x04 || x || y, each F_p2 coordinate written high dimension first (u-coefficient then constant), 32 bytes per F_p component; 129 bytes total.

      • decode

        public static SM9G2Point decode​(byte[] enc)

      • equals

        public boolean equals​(java.lang.Object other)
        Overrides:
        equals in class java.lang.Object

      • hashCode

        public int hashCode()
        Overrides:
        hashCode in class java.lang.Object