org.bouncycastle.crypto.bls

Class BLS12_381Serialization

java.lang.Object

org.bouncycastle.crypto.bls.BLS12_381Serialization

public class BLS12_381Serialization
extends java.lang.Object

Zcash-format compressed point serialization for BLS12-381 G1 and G2, matching the encoding used by Zcash, Eth2, Filecoin, and the IETF pairing-friendly-curves draft.

G1 compressed encoding is 48 bytes; G2 compressed encoding is 96 bytes. The high three bits of the first byte are flags:

• bit 7 (0x80): compressed (always set in this format)
• bit 6 (0x40): infinity (set iff this is the point at infinity)
• bit 5 (0x20): y-sign (set iff y > -y in the encoded byte order)

Because BLS12-381 Fp is 381 bits, the x-coordinate big-endian bytes have three free top bits, which is where the flag bits live. For Fp² coordinates, Zcash convention orders (c1, c0) — the imaginary part first.

The y-sign flag uses the lexicographic ordering of the encoded y versus -y: for Fp this reduces to y > (p-1)/2, for Fp² to "y.c1 > (p-1)/2, or y.c0 > (p-1)/2 when y.c1 == 0".

Decompression validates the curve equation and the flag combinations but does not perform a prime-order subgroup check — callers that need a validated public key or a subgroup-checked signature should do that explicitly.

Method Summary

Modifier and Type	Method and Description
static byte[]	compressG1(ECPoint point) Compress a G1 point to its 48-byte Zcash-format encoding.
static byte[]	compressG2(BLS12_381G2Point point) Compress a G2 point to its 96-byte Zcash-format encoding.
static ECPoint	decompressG1(byte[] bytes, ECCurve curve) Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve.
static BLS12_381G2Point	decompressG2(byte[] bytes) Decompress a 96-byte Zcash-format encoding back to a G2 point.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

compressG1

public static byte[] compressG1(ECPoint point)

Compress a G1 point to its 48-byte Zcash-format encoding.

decompressG1

public static ECPoint decompressG1(byte[] bytes,
                                   ECCurve curve)

Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve. Validates the flag combinations and the curve equation; does not subgroup-check.

compressG2

public static byte[] compressG2(BLS12_381G2Point point)

Compress a G2 point to its 96-byte Zcash-format encoding.

decompressG2

public static BLS12_381G2Point decompressG2(byte[] bytes)

Decompress a 96-byte Zcash-format encoding back to a G2 point. Validates the flag combinations, that the recovered x is in Fp², and that (x, y) satisfies the G2 curve equation; does not subgroup-check.