Class Fp12

java.lang.Object
org.bouncycastle.math.ec.sm9.Fp12
public class Fp12 extends Object
Element of F_p12 = F_p4[w]/(w^3 - v), i.e. w^3 = v, for SM9 (GM/T 0044.5-2016, 1-2-4-12 tower). This is the pairing target group G_T. Written a + b*w + c*w^2 with a the low and c the high (w^2-coefficient) dimension, a, b, c in Fp4. Immutable.

  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
    equals(Object other)
     
    int
    hashCode()
     
    Fp12
    multiply(Fp12 o)
     
    Fp12
    pow(BigInteger e)
    Variable-time exponentiation, for PUBLIC exponents only (the pairing's Frobenius and final exponentiation, and g^h' in signature verification).
    Fp12
    powSecure(BigInteger e)
    Constant-pattern exponentiation for SECRET exponents (a Montgomery ladder running a fixed number of iterations - the SM9 group order bit length - with exactly one multiply and one square per bit regardless of the exponent bits), used for w = g^r where r is a signing nonce or ephemeral secret.

    Methods inherited from class Object

    clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

  • Method Details

    • multiply

      public Fp12 multiply(Fp12 o)

    • pow

      public Fp12 pow(BigInteger e)
      Variable-time exponentiation, for PUBLIC exponents only (the pairing's Frobenius and final exponentiation, and g^h' in signature verification). For secret exponents use powSecure(BigInteger).

    • powSecure

      public Fp12 powSecure(BigInteger e)
      Constant-pattern exponentiation for SECRET exponents (a Montgomery ladder running a fixed number of iterations - the SM9 group order bit length - with exactly one multiply and one square per bit regardless of the exponent bits), used for w = g^r where r is a signing nonce or ephemeral secret. Unlike pow(BigInteger), the operation pattern does not leak the exponent's Hamming weight or individual bits. The exponent must satisfy 0 <= e < N (every SM9 secret exponent is reduced mod the group order N).

      NOTE: the underlying F_p arithmetic is BigInteger-based and is not itself constant time, so this removes the exponent-structure leak but not every timing side channel.

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object