org.bouncycastle.crypto.bls

Class BLS12_381G2Point

java.lang.Object

org.bouncycastle.crypto.bls.BLS12_381G2Point

public final class BLS12_381G2Point
extends java.lang.Object

Affine point on the BLS12-381 G2 curve E: y^2 = x^3 + 4*(1+I) over Fp^2.

Points are held in affine coordinates. add(org.bouncycastle.crypto.bls.BLS12_381G2Point) and doublePoint() work affinely, one Fp2Element.inverse() each; the two scalar multiplications run in Jacobian coordinates (x = X/Z^2, y = Y/Z^3) with mixed additions of affine points, so they need a single inversion to return to affine form at the end (plus one for the GLS table of constantTimeMultiply(java.math.BigInteger) on G2).

Two scalar-multiplication APIs are provided: multiply(java.math.BigInteger) is the variable-time double-and-add — fast for public scalars (cofactor clearing, subgroup checks) but unsafe for secret scalars; and constantTimeMultiply(java.math.BigInteger) has a fixed iteration pattern, for use with secret scalars (e.g. sk * H(msg) in BLS sign).

Field Summary

Fields

Modifier and Type	Field and Description
static Fp2Element	B B coefficient: 4 * (1 + I).
static BLS12_381G2Point	INFINITY The point at infinity (identity element).

Method Summary

Modifier and Type	Method and Description
BLS12_381G2Point	add(BLS12_381G2Point other)
BLS12_381G2Point	constantTimeMultiply(java.math.BigInteger scalar) Constant-time scalar multiplication, suitable for secret scalars (e.g.
BLS12_381G2Point	doublePoint()
boolean	equals(java.lang.Object other)
int	hashCode()
boolean	isInfinity()
BLS12_381G2Point	multiply(java.math.BigInteger scalar) Variable-time double-and-add scalar multiplication.
BLS12_381G2Point	negate()
static BLS12_381G2Point	of(Fp2Element x, Fp2Element y) Constructs a G2 point from affine coordinates and verifies that (x, y) satisfies the curve equation y^2 = x^3 + 4*(1+I).
java.lang.String	toString()
Fp2Element	x()
Fp2Element	y()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Detail

B

public static final Fp2Element B

B coefficient: 4 * (1 + I).

INFINITY

public static final BLS12_381G2Point INFINITY

The point at infinity (identity element).

Method Detail

of

public static BLS12_381G2Point of(Fp2Element x,
                                  Fp2Element y)

Constructs a G2 point from affine coordinates and verifies that (x, y) satisfies the curve equation y^2 = x^3 + 4*(1+I).

isInfinity

public boolean isInfinity()

x

public Fp2Element x()

y

public Fp2Element y()

negate

public BLS12_381G2Point negate()

add

public BLS12_381G2Point add(BLS12_381G2Point other)

doublePoint

public BLS12_381G2Point doublePoint()

constantTimeMultiply

public BLS12_381G2Point constantTimeMultiply(java.math.BigInteger scalar)

Constant-time scalar multiplication, suitable for secret scalars (e.g. sk * H(msg) in BLS sign).

Points in G2 (the usual case, checked with BLS12_381SubgroupCheck.isInG2Subgroup(org.bouncycastle.crypto.bls.BLS12_381G2Point), which looks only at the public point) use the GLS method, with four 64-bit digits and the endomorphism ψ (64 doublings and 64 additions). Other points use a fixed-iteration "double, conditionally add" ladder over 256 bits. In both, the conditional addition is always computed and then chosen by an array-indexed select rather than an if, so every iteration performs the same point operations whatever the scalar bits.

Caveats. "Constant-time" here means the scalar-bit-pattern-independent at the scalar-mult loop level. The underlying Jacobian point ops still have data-dependent branches for the infinity / equal-x cases of the mixed addition (the accumulator is at infinity until the scalar's first set bit; the equal-x cases are negligibly probable for random secret scalars on a prime-order subgroup), the BigInteger field arithmetic is not constant time, and the JVM itself may introduce cache / GC / JIT timing variance that pure Java cannot fully eliminate. Sufficient against a remote network timing attacker on a typical workload; not a substitute for a constant-time native implementation against a co-located adversary with cache-line resolution.

multiply

public BLS12_381G2Point multiply(java.math.BigInteger scalar)

Variable-time double-and-add scalar multiplication. Suitable for non-secret scalars (e.g. cofactor clearing); not safe for secret scalar use — see constantTimeMultiply(java.math.BigInteger).

equals

public boolean equals(java.lang.Object other)

Overrides:

equals in class java.lang.Object

hashCode

public int hashCode()

Overrides:

hashCode in class java.lang.Object

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object