Package org.bouncycastle.crypto.bls

Class BLS12_381G1

  • public class BLS12_381G1
extends java.lang.Object
    Curve parameters for BLS12-381 G1, the prime-order subgroup of E(Fp) defined by y^2 = x^3 + 4 over Fp, as standardised in draft-irtf-cfrg-bls-signature and RFC 9380 sec. 8.8.1.

    The curve is exposed via the standard ECCurve.Fp (BigInteger-backed) so that hash-to-curve and other G1-only consumers can be built on top without depending on a custom limb-array representation.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static java.math.BigInteger COFACTOR
      G1 cofactor h.
      static java.math.BigInteger H_EFF
      Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): h_eff = 1 - x where x = -0xd201000000010000 is the BLS12-381 trace parameter, so h_eff = 0xd201000000010001.
      static java.math.BigInteger ORDER
      G1 prime-order subgroup order r. 255 bits.
      static java.math.BigInteger Q
      Base field characteristic p. 381 bits.

    • Field Detail

      • Q

        public static final java.math.BigInteger Q
        Base field characteristic p. 381 bits.

      • ORDER

        public static final java.math.BigInteger ORDER
        G1 prime-order subgroup order r. 255 bits.

      • COFACTOR

        public static final java.math.BigInteger COFACTOR
        G1 cofactor h.

      • H_EFF

        public static final java.math.BigInteger H_EFF
        Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): h_eff = 1 - x where x = -0xd201000000010000 is the BLS12-381 trace parameter, so h_eff = 0xd201000000010001. Multiplying any point on E(Fp) by h_eff lands in the prime-order subgroup; this is faster than the full cofactor multiplication and is the form mandated by the hash-to-curve suite.

    • Method Detail

      • createCurve

        public static ECCurve createCurve()
        Returns:
        a fresh ECCurve instance for BLS12-381 G1 (y^2 = x^3 + 4 over Fp). Each call returns an independent curve; consumers that build derived structures (auxiliary isogeny curves, lookup tables, etc.) should reuse one instance.

      • getGenerator

        public static ECPoint getGenerator​(ECCurve curve)
        Returns:
        the standard generator G1 of the prime-order subgroup, on the given curve instance (must be an instance returned by createCurve()).

      • constantTimeMultiply

        public static ECPoint constantTimeMultiply​(ECPoint p,
                                           java.math.BigInteger scalar)
        Constant-time scalar multiplication on G1, suitable for secret scalars (e.g. sk * G1_gen in skToPk).

        Same approach as BLS12_381G2Point.constantTimeMultiply(java.math.BigInteger): a fixed-iteration "double, conditionally add" ladder over 256 bits with an array-indexed select replacing the bit-conditional if. Same caveats apply — the underlying BC ECPoint arithmetic still has data-dependent branches for infinity / equal-x cases (negligibly probable for random secret scalars on a prime-order subgroup), and JVM-level timing variance is not addressable in pure Java.