Package org.bouncycastle.crypto.bls

Class BLS12_381Serialization

  • public class BLS12_381Serialization
extends java.lang.Object
    Zcash-format compressed point serialization for BLS12-381 G1 and G2, matching the encoding used by Zcash, Eth2, Filecoin, and the IETF pairing-friendly-curves draft.

    G1 compressed encoding is 48 bytes; G2 compressed encoding is 96 bytes. The high three bits of the first byte are flags:

    • bit 7 (0x80): compressed (always set in this format)
    • bit 6 (0x40): infinity (set iff this is the point at infinity)
    • bit 5 (0x20): y-sign (set iff y > -y in the encoded byte order)
    Because BLS12-381 Fp is 381 bits, the x-coordinate big-endian bytes have three free top bits, which is where the flag bits live. For Fp² coordinates, Zcash convention orders (c1, c0) — the imaginary part first.

    The y-sign flag uses the lexicographic ordering of the encoded y versus -y: for Fp this reduces to y > (p-1)/2, for Fp² to "y.c1 > (p-1)/2, or y.c0 > (p-1)/2 when y.c1 == 0".

    Decompression validates the curve equation and the flag combinations but does not perform a prime-order subgroup check — callers that need a validated public key or a subgroup-checked signature should do that explicitly.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static byte[] compressG1​(ECPoint point)
      Compress a G1 point to its 48-byte Zcash-format encoding.
      static byte[] compressG2​(BLS12_381G2Point point)
      Compress a G2 point to its 96-byte Zcash-format encoding.
      static ECPoint decompressG1​(byte[] bytes, ECCurve curve)
      Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve.
      static BLS12_381G2Point decompressG2​(byte[] bytes)
      Decompress a 96-byte Zcash-format encoding back to a G2 point.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Method Detail

      • compressG1

        public static byte[] compressG1​(ECPoint point)
        Compress a G1 point to its 48-byte Zcash-format encoding.

      • decompressG1

        public static ECPoint decompressG1​(byte[] bytes,
                                   ECCurve curve)
        Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve. Validates the flag combinations and the curve equation; does not subgroup-check.

      • compressG2

        public static byte[] compressG2​(BLS12_381G2Point point)
        Compress a G2 point to its 96-byte Zcash-format encoding.

      • decompressG2

        public static BLS12_381G2Point decompressG2​(byte[] bytes)
        Decompress a 96-byte Zcash-format encoding back to a G2 point. Validates the flag combinations, that the recovered x is in Fp², and that (x, y) satisfies the G2 curve equation; does not subgroup-check.