org.bouncycastle.math.ec.sm9

Class SM9G2Point

java.lang.Object

org.bouncycastle.math.ec.sm9.SM9G2Point

public class SM9G2Point
extends java.lang.Object

Affine point of the group G2 for SM9: the sextic twist E'(F_p2): y^2 = x^3 + 5u (GM/T 0044.5-2016). Immutable. G1 by contrast is an ordinary prime-field curve handled by ECCurve.Fp.

Method Summary

Modifier and Type	Method and Description
SM9G2Point	add(SM9G2Point o)
static SM9G2Point	decode(byte[] enc)
boolean	equals(java.lang.Object other)
byte[]	getEncoded() Uncompressed encoding 0x04 || x || y, each F_p2 coordinate written high dimension first (u-coefficient then constant), 32 bytes per F_p component; 129 bytes total.
int	hashCode()
boolean	isInfinity()
SM9G2Point	multiply(java.math.BigInteger k) Scalar multiplication by a Montgomery ladder, maintaining the invariant r1 = r0 + this and returning [k]this.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, toString, wait, wait, wait

Method Detail

isInfinity

public boolean isInfinity()

add

public SM9G2Point add(SM9G2Point o)

multiply

public SM9G2Point multiply(java.math.BigInteger k)

Scalar multiplication by a Montgomery ladder, maintaining the invariant r1 = r0 + this and returning [k]this. The loop runs a fixed, scalar-independent number of iterations (the group order bit length) doing exactly one point addition and one doubling per bit, so it removes the Hamming-weight and bit-length leaks of the plain double-and-add it replaces.

NOTE: this is a hardening, not a full constant-time guarantee. The per-bit if/else selects which running point is updated (a data-dependent branch), the INFINITY fast paths in add(org.bouncycastle.math.ec.sm9.SM9G2Point)/twice() make the leading-zero prefix of the scalar cheaper (leaking its most-significant-bit position), and the underlying F_p2 arithmetic is BigInteger-based and not itself constant time. It is used only for the two secret scalars in offline KGC key derivation ([ks]P2 and [t2]P2); a fully constant-time G2 would need a uniform, sentinel-free point representation over a fixed-limb F_p2.

getEncoded

public byte[] getEncoded()

Uncompressed encoding 0x04 || x || y, each F_p2 coordinate written high dimension first (u-coefficient then constant), 32 bytes per F_p component; 129 bytes total.

decode

public static SM9G2Point decode(byte[] enc)

equals

public boolean equals(java.lang.Object other)

Overrides:

equals in class java.lang.Object

hashCode

public int hashCode()

Overrides:

hashCode in class java.lang.Object