Class SM9Curve

java.lang.Object
org.bouncycastle.math.ec.sm9.SM9Curve
public class SM9Curve extends Object
Fixed system parameters of the SM9 256-bit BN curve (GM/T 0044.5-2016, clause 1).

Curve E: y^2 = x^3 + 5 over F_q. G1 is the prime-order subgroup of E(F_q) with generator P1; G2 is the subgroup of the sextic twist E'(F_p2): y^2 = x^3 + 5u with generator P2. The R-ate pairing e: G1 x G2 -> G_T uses loop parameter 6t+2.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final ECCurve
    G1
     
    static final BigInteger
    N
     
    static final ECPoint
    P1
     
    static final SM9G2Point
    P2
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static ECPoint
    g1FromBytes(byte[] b, int off)
    Reconstruct a G1 point from its 64-byte x || y encoding.
    static byte[]
    g1ToBytes(ECPoint p)
    Encode a G1 point as x || y (32 bytes each, big-endian), the affine-coordinate form SM9 concatenates into KDF/MAC inputs and ciphertexts (no 0x04 prefix).
    static ECPoint
    multiplySecure(ECPoint p, BigInteger k)
    Constant-time G1 scalar multiplication for secret scalars, used for every SM9 scalar multiplication by private key material or an ephemeral secret (whether the base is the fixed generator P1 or a variable point such as a user's private-key point or a recipient point).

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

  • Method Details

    • g1ToBytes

      public static byte[] g1ToBytes(ECPoint p)
      Encode a G1 point as x || y (32 bytes each, big-endian), the affine-coordinate form SM9 concatenates into KDF/MAC inputs and ciphertexts (no 0x04 prefix).

    • g1FromBytes

      public static ECPoint g1FromBytes(byte[] b, int off)
      Reconstruct a G1 point from its 64-byte x || y encoding. The caller is responsible for validating the result (e.g. ECPoint.isValid()).

    • multiplySecure

      public static ECPoint multiplySecure(ECPoint p, BigInteger k)
      Constant-time G1 scalar multiplication for secret scalars, used for every SM9 scalar multiplication by private key material or an ephemeral secret (whether the base is the fixed generator P1 or a variable point such as a user's private-key point or a recipient point). The comb runs a fixed number of steps and reads its precomputed table in constant time, so the number and pattern of point operations do not depend on the scalar - unlike the default windowed-NAF multiplier that ECPoint.multiply(BigInteger) would use.

      NOTE: G1 is backed by the fixed-limb Montgomery field SM9P256V1Field, so its field arithmetic is constant time; the residual variable-time cost is only the final conditional subtract / carry normalisation, as in BouncyCastle's other custom prime-field curves.