org.bouncycastle.math.ec.sm9
Class Fp12

java.lang.Object
  org.bouncycastle.math.ec.sm9.Fp12

public class Fp12

extends java.lang.Object

Element of F_p12 = F_p4[w]/(w^3 - v), i.e. w^3 = v, for SM9 (GM/T 0044.5-2016, 1-2-4-12 tower). This is the pairing target group G_T. Written a + b*w + c*w^2 with a the low and c the high (w^2-coefficient) dimension, a, b, c in Fp4. Immutable.

Method Summary

boolean	equals(java.lang.Object other)
int	hashCode()
Fp12	multiply(Fp12 o)
Fp12	pow(java.math.BigInteger e) Variable-time exponentiation, for PUBLIC exponents only (the pairing's Frobenius and final exponentiation, and g^h' in signature verification).
Fp12	powSecure(java.math.BigInteger e) Constant-pattern exponentiation for SECRET exponents (a Montgomery ladder running a fixed number of iterations - the SM9 group order bit length - with exactly one multiply and one square per bit regardless of the exponent bits), used for w = g^r where r is a signing nonce or ephemeral secret.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Method Detail

multiply

public Fp12 multiply(Fp12 o)

pow

public Fp12 pow(java.math.BigInteger e)

Variable-time exponentiation, for PUBLIC exponents only (the pairing's Frobenius and final exponentiation, and g^h' in signature verification). For secret exponents use powSecure(java.math.BigInteger).

powSecure

public Fp12 powSecure(java.math.BigInteger e)

Constant-pattern exponentiation for SECRET exponents (a Montgomery ladder running a fixed number of iterations - the SM9 group order bit length - with exactly one multiply and one square per bit regardless of the exponent bits), used for w = g^r where r is a signing nonce or ephemeral secret. Unlike pow(java.math.BigInteger), the operation pattern does not leak the exponent's Hamming weight or individual bits. The exponent must satisfy 0 <= e < N (every SM9 secret exponent is reduced mod the group order N).

NOTE: the underlying F_p arithmetic is BigInteger-based and is not itself constant time, so this removes the exponent-structure leak but not every timing side channel.

equals

public boolean equals(java.lang.Object other)

hashCode

public int hashCode()