org.bouncycastle.crypto.bls

Class BLS12_381G2HashToCurve

java.lang.Object

org.bouncycastle.crypto.bls.BLS12_381G2HashToCurve

public class BLS12_381G2HashToCurve
extends java.lang.Object

Implementation of the BLS12381G2_XMD:SHA-256_SSWU_RO_ hash-to-curve suite (RFC 9380 sec. 8.8.2): a deterministic, uniform map from a byte string and a domain-separation tag to a point in the BLS12-381 G2 prime-order subgroup.

Pipeline:

1. expand_message_xmd(msg, dst, 256) produces 256 bytes (count=2, m=2, L=64).
2. The bytes are split into two Fp^2 elements u[0], u[1].
3. Each is run through SSWU on the 3-isogenous helper curve E' (with A' = 240*I, B' = 1012*(1+I), Z = -(2+I)).
4. The results are mapped to E by the iso_3 rational map (RFC 9380 App. E.3).
5. The two G2 points are added, and the cofactor is cleared by scalar-multiplication by h_eff.

Constructor Summary

Constructors

Constructor and Description
BLS12_381G2HashToCurve(byte[] dst)

Method Summary

Modifier and Type	Method and Description
BLS12_381G2Point	hashToCurve(byte[] message)
Fp2Element[]	hashToField(byte[] message) Stage 1: expands message into two Fp² field elements per RFC 9380 sec. 5.3.
BLS12_381G2Point	mapToCurveAndIso3(Fp2Element u) Stages 2-3: simplified SWU on E' followed by iso_3 to E.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

BLS12_381G2HashToCurve

public BLS12_381G2HashToCurve(byte[] dst)

Method Detail

hashToCurve

public BLS12_381G2Point hashToCurve(byte[] message)

hashToField

public Fp2Element[] hashToField(byte[] message)

Stage 1: expands message into two Fp² field elements per RFC 9380 sec. 5.3. Exposed for layered testing and for callers that want the raw field elements without the curve mapping.

mapToCurveAndIso3

public BLS12_381G2Point mapToCurveAndIso3(Fp2Element u)

Stages 2-3: simplified SWU on E' followed by iso_3 to E. Exposed for layered testing; returns a point on E that has not yet had its cofactor cleared, so it is generally not in the prime-order subgroup.