org.bouncycastle.math.ec.sm9

Class SM9Curve

java.lang.Object

org.bouncycastle.math.ec.sm9.SM9Curve

public class SM9Curve
extends java.lang.Object

Fixed system parameters of the SM9 256-bit BN curve (GM/T 0044.5-2016, clause 1).

Curve E: y^2 = x^3 + 5 over F_q. G1 is the prime-order subgroup of E(F_q) with generator P1; G2 is the subgroup of the sextic twist E'(F_p2): y^2 = x^3 + 5u with generator P2. The R-ate pairing e: G1 x G2 -> G_T uses loop parameter 6t+2.

Field Summary

Fields

Modifier and Type	Field and Description
static ECCurve	G1
static java.math.BigInteger	N
static ECPoint	P1
static SM9G2Point	P2

Method Summary

Modifier and Type	Method and Description
static ECPoint	g1FromBytes(byte[] b, int off) Reconstruct a G1 point from its 64-byte x || y encoding.
static byte[]	g1ToBytes(ECPoint p) Encode a G1 point as x || y (32 bytes each, big-endian), the affine-coordinate form SM9 concatenates into KDF/MAC inputs and ciphertexts (no 0x04 prefix).
static ECPoint	multiplySecure(ECPoint p, java.math.BigInteger k) Constant-time G1 scalar multiplication for secret scalars, used for every SM9 scalar multiplication by private key material or an ephemeral secret (whether the base is the fixed generator P1 or a variable point such as a user's private-key point or a recipient point).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

N

public static final java.math.BigInteger N

G1

public static final ECCurve G1

P1

public static final ECPoint P1

P2

public static final SM9G2Point P2

Method Detail

g1ToBytes

public static byte[] g1ToBytes(ECPoint p)

Encode a G1 point as x || y (32 bytes each, big-endian), the affine-coordinate form SM9 concatenates into KDF/MAC inputs and ciphertexts (no 0x04 prefix).

g1FromBytes

public static ECPoint g1FromBytes(byte[] b,
                                  int off)

Reconstruct a G1 point from its 64-byte x || y encoding. The caller is responsible for validating the result (e.g. ECPoint.isValid()).

multiplySecure

public static ECPoint multiplySecure(ECPoint p,
                                     java.math.BigInteger k)

Constant-time G1 scalar multiplication for secret scalars, used for every SM9 scalar multiplication by private key material or an ephemeral secret (whether the base is the fixed generator P1 or a variable point such as a user's private-key point or a recipient point). The comb runs a fixed number of steps and reads its precomputed table in constant time, so the number and pattern of point operations do not depend on the scalar - unlike the default windowed-NAF multiplier that ECPoint.multiply(java.math.BigInteger) would use.

NOTE: G1 is backed by the fixed-limb Montgomery field SM9P256V1Field, so its field arithmetic is constant time; the residual variable-time cost is only the final conditional subtract / carry normalisation, as in BouncyCastle's other custom prime-field curves.