HashToEllipticCurve (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.hash2curve

## Class HashToEllipticCurve

- java.lang.Object
- - org.bouncycastle.crypto.hash2curve.HashToEllipticCurve

-     public class HashToEllipticCurve
      extends java.lang.Object

  Main class for implementing hash to elliptic curve according to RFC 9380

  `Steps: 1. u = hash_to_field(msg, 2) 2. Q0 = map_to_curve(u[0]) 3. Q1 = map_to_curve(u[1]) 4. R = Q0 + Q1 # Point addition 5. P = clear_cofactor(R) 6. return P`

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `protected CurveProcessor` | `curveProcessor`
    `protected HashToField` | `hashToField`
    `protected MapToCurve` | `mapToCurve`

  - ### Constructor Summary

    Constructors
    Modifier | Constructor and Description
    --- | ---
    `protected` | `HashToEllipticCurve(HashToField hashToField, MapToCurve mapToCurve, CurveProcessor curveProcessor)`

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `ECPoint` | `encodeToCurve(byte[] message)` Encode a message to an elliptic curve point using the RFC 9380 encode_to_curve function.
    `AffineXY` | `getAffineXY(ECPoint point)` Converts an elliptic-curve point into the affine (x, y) coordinate representation defined by the hash-to-curve suite.
    `static HashToEllipticCurve` | `getInstance(HashToCurveProfile profile, java.lang.String dst)`
    `ECPoint` | `hashToCurve(byte[] message)` Hashes a message to an elliptic curve point using the RFC 9380 hash_to_curve function.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### hashToField

          protected final HashToField hashToField

    - #### mapToCurve

          protected final MapToCurve mapToCurve

    - #### curveProcessor

          protected final CurveProcessor curveProcessor

  - ### Constructor Detail

    - #### HashToEllipticCurve

          protected HashToEllipticCurve(HashToField hashToField,
                                        MapToCurve mapToCurve,
                                        CurveProcessor curveProcessor)

  - ### Method Detail

    - #### getInstance

          public static HashToEllipticCurve getInstance(HashToCurveProfile profile,
                                                        java.lang.String dst)

    - #### hashToCurve

          public ECPoint hashToCurve(byte[] message)

      Hashes a message to an elliptic curve point using the RFC 9380 hash_to_curve function. This function provides a uniform distribution of resulting points.
      Parameters:
        `message` - the message to be hashed
      Returns:
        the resulting elliptic curve point P

    - #### encodeToCurve

          public ECPoint encodeToCurve(byte[] message)

      Encode a message to an elliptic curve point using the RFC 9380 encode_to_curve function. This function does not provide a uniform distribution of resulting points. This function MUST NOT be used when uniform distribution is a security requirement.
      Parameters:
        `message` - the message to be hashed
      Returns:
        the resulting elliptic curve point P

    - #### getAffineXY

          public AffineXY getAffineXY(ECPoint point)

      Converts an elliptic-curve point into the affine (x, y) coordinate representation defined by the hash-to-curve suite.

      The returned coordinates are intended for serialization, testing, and interoperability with the reference outputs defined in RFC 9380. For most Weierstrass curves, this is simply the affine (x, y) coordinates of the given point. For curves that use a different coordinate model in the specification (e.g. Montgomery curves such as curve25519), this method applies the appropriate coordinate transformation.

      This method does not change the underlying group element represented by the point. It only changes how that point is expressed as field elements. The input point is expected to be a valid point on the curve used by the implementation.

      Parameters:
        `point` - point on the chosen ECCurve for the selected hash2Curve profile
      Returns:
        AffineXY coordinates for the point on the curve defined in RFC 9380 for the selected profile