org.bouncycastle.math.ec.sm9
Class SM9Pairing

java.lang.Object
  org.bouncycastle.math.ec.sm9.SM9Pairing

public class SM9Pairing

extends java.lang.Object

The SM9 R-ate pairing e: G1 x G2 -> G_T over the 256-bit BN curve (GM/T 0044.5-2016). Computed as the optimal-ate/R-ate Miller loop with loop parameter 6t+2, a two-term Frobenius tail, and the final exponentiation f^((q^12-1)/N).

The Miller loop runs over the non-adjacent form of 6t+2, on the twist E'(F_p2) itself, in homogeneous projective coordinates, and evaluates each line at P as a sparse element of F_p12 - see . The Frobenius images of Q are the conjugates of its coordinates times constants, and the final exponentiation is split in two: f^((q^6 - 1)(q^2 + 1)) by the Frobenius, which costs one inversion, and the rest, (q^4 - q^2 + 1)/N, 767 bits of the 2811-bit exponent, by three exponentiations by the 63-bit BN parameter t and the Frobenius - see .

On the decryption, KEM and key-exchange paths the second argument is the user's private key, and the first is chosen by whoever supplied the ciphertext or the ephemeral value. The F_p arithmetic underneath, Fp's, runs in constant time, and the loop does not start from Q but from a random representative of it, (x Z, y Z, Z) for a non-zero Z drawn afresh for each call: every coordinate and every line value derived from the key then carries a random factor that no two calls share, and an observer choosing the first argument has no fixed secret operand to average measurements against. The factors lie in F_p2, which the first step of the final exponentiation annihilates, so the result is unchanged; the value the exponentiation runs on is given a random factor of its own before that step, one the exponentiation annihilates in turn - see . The lines through Q and -Q, and through the Frobenius images of Q, which are computed from Q as it is, take the affine coordinates of those points as they are - values fixed by the key, though not touched by the first argument.

The first argument is the point the loop's lines are evaluated at, and pairing(org.bouncycastle.math.ec.ECPoint, org.bouncycastle.math.ec.sm9.SM9G2Point) evaluates them at its affine coordinates, the same two values in every line of every call: it takes that point to be public.

multiPair(org.bouncycastle.math.ec.ECPoint[], org.bouncycastle.math.ec.sm9.SM9G2Point[]) takes a product of pairings in one Miller loop and one final exponentiation, for signature verification and for the pairing value a master public key fixes, without this randomisation: its arguments must all be public.

Method Summary

static Fp12	multiPair(ECPoint[] p, SM9G2Point[] q) The product e(P_0, Q_0) e(P_1, Q_1) [] of the pairings of p[i] in G1 and q[i] in G2, in one Miller loop, whose squarings the pairs share, and one final exponentiation.
static Fp12	pairing(ECPoint p, SM9G2Point q) e(P, Q) for P in G1 (a point of E(F_q)) and Q in G2 (a point of the twist).
static byte[]	toBytes(Fp12 z) Serialize a G_T element to bytes per GM/T 0044.5: high dimension first, recursively over the 1-2-4-12 tower (w^2, w^1, w^0; then v^1, v^0; then u^1, u^0), 32 bytes per F_q component; 384 bytes total.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

pairing

public static Fp12 pairing(ECPoint p,
                           SM9G2Point q)

e(P, Q) for P in G1 (a point of E(F_q)) and Q in G2 (a point of the twist). P is taken to be public.

multiPair

public static Fp12 multiPair(ECPoint[] p,
                             SM9G2Point[] q)

The product e(P_0, Q_0) e(P_1, Q_1) [] of the pairings of p[i] in G1 and q[i] in G2, in one Miller loop, whose squarings the pairs share, and one final exponentiation. Signature verification's w' = e(S, [h1]P2 + P_pub-s) g^h is, by bilinearity, e([h1]S, P2) e(S + [h]P1, P_pub-s), which this gives in about the time of one pairing(org.bouncycastle.math.ec.ECPoint, org.bouncycastle.math.ec.sm9.SM9G2Point); and the pairing value a master public key fixes, e(P_pub-e, P2) or e(P1, P_pub-s), whose arguments are public as well, is the product of one pair.

For public arguments only. Unlike pairing(org.bouncycastle.math.ec.ECPoint, org.bouncycastle.math.ec.sm9.SM9G2Point), it does not randomise its operands: the Miller loop starts from each Q itself and the final exponentiation takes no random factor, so every value it works on is fixed by its arguments, and a private key passed here would be exposed to whoever can observe the computation. The lines of each Q's loop depend on Q alone, so they are computed on the Q's first use here and kept with it - P2's once, and a master public key's for as long as the key object lives - where pairing(org.bouncycastle.math.ec.ECPoint, org.bouncycastle.math.ec.sm9.SM9G2Point) computes its point's afresh, from a random representative, on every call. A pair with either point at infinity contributes 1; the G1 points are validated as pairing(org.bouncycastle.math.ec.ECPoint, org.bouncycastle.math.ec.sm9.SM9G2Point) validates its first argument, and brought to affine coordinates without a random draw, and the G2 points, like its second, are taken to be points of G2.

toBytes

public static byte[] toBytes(Fp12 z)

Serialize a G_T element to bytes per GM/T 0044.5: high dimension first, recursively over the 1-2-4-12 tower (w^2, w^1, w^0; then v^1, v^0; then u^1, u^0), 32 bytes per F_q component; 384 bytes total.