org.bouncycastle.math.ec.sm9
Class SM9Pairing

java.lang.Object
  org.bouncycastle.math.ec.sm9.SM9Pairing

public class SM9Pairing

extends java.lang.Object

The SM9 R-ate pairing e: G1 x G2 -> G_T over the 256-bit BN curve (GM/T 0044.5-2016). Computed as the optimal-ate/R-ate Miller loop with loop parameter 6t+2, a two-term Frobenius tail, and the final exponentiation f^((q^12-1)/N).

This is a correctness-first reference implementation: the Miller loop runs in F_p12 on the twist image, and the Frobenius/final exponentiation are ordinary F_p12 exponentiations. It is deliberately straightforward, not optimised.

Method Summary

static Fp12	pairing(ECPoint p, SM9G2Point q) e(P, Q) for P in G1 (a point of E(F_q)) and Q in G2 (a point of the twist).
static byte[]	toBytes(Fp12 z) Serialize a G_T element to bytes per GM/T 0044.5: high dimension first, recursively over the 1-2-4-12 tower (w^2, w^1, w^0; then v^1, v^0; then u^1, u^0), 32 bytes per F_q component; 384 bytes total.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

pairing

public static Fp12 pairing(ECPoint p,
                           SM9G2Point q)

e(P, Q) for P in G1 (a point of E(F_q)) and Q in G2 (a point of the twist).

toBytes

public static byte[] toBytes(Fp12 z)

Serialize a G_T element to bytes per GM/T 0044.5: high dimension first, recursively over the 1-2-4-12 tower (w^2, w^1, w^0; then v^1, v^0; then u^1, u^0), 32 bytes per F_q component; 384 bytes total.