BLS12_381G1 (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.bls

## Class BLS12_381G1

- java.lang.Object
- - org.bouncycastle.crypto.bls.BLS12_381G1

-     public class BLS12_381G1
      extends java.lang.Object

  Curve parameters for BLS12-381 G1, the prime-order subgroup of `E(Fp)` defined by `y^2 = x^3 + 4` over `Fp`, as standardised in draft-irtf-cfrg-bls-signature and RFC 9380 sec. 8.8.1.

  The curve is exposed via the standard `ECCurve.Fp` (BigInteger-backed) so that hash-to-curve and other G1-only consumers can be built on top without depending on a custom limb-array representation.

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static java.math.BigInteger` | `COFACTOR` G1 cofactor h.
    `static java.math.BigInteger` | `H_EFF` Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): `h_eff = 1 - x` where `x = -0xd201000000010000` is the BLS12-381 trace parameter, so `h_eff = 0xd201000000010001`.
    `static java.math.BigInteger` | `ORDER` G1 prime-order subgroup order r. 255 bits.
    `static java.math.BigInteger` | `Q` Base field characteristic p. 381 bits.

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static ECPoint` | `constantTimeMultiply(ECPoint p, java.math.BigInteger scalar)` Constant-time scalar multiplication on G1, suitable for secret scalars (e.g.
    `static ECCurve` | `createCurve()`
    `static ECPoint` | `getGenerator(ECCurve curve)`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### Q

          public static final java.math.BigInteger Q

      Base field characteristic p. 381 bits.

    - #### ORDER

          public static final java.math.BigInteger ORDER

      G1 prime-order subgroup order r. 255 bits.

    - #### COFACTOR

          public static final java.math.BigInteger COFACTOR

      G1 cofactor h.

    - #### H_EFF

          public static final java.math.BigInteger H_EFF

      Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): `h_eff = 1 - x` where `x = -0xd201000000010000` is the BLS12-381 trace parameter, so `h_eff = 0xd201000000010001`. Multiplying any point on E(Fp) by h_eff lands in the prime-order subgroup; this is faster than the full cofactor multiplication and is the form mandated by the hash-to-curve suite.

  - ### Method Detail

    - #### createCurve

          public static ECCurve createCurve()

      Returns:
        a fresh `ECCurve` instance for BLS12-381 G1 (`y^2 = x^3 + 4` over Fp). Each call returns an independent curve; consumers that build derived structures (auxiliary isogeny curves, lookup tables, etc.) should reuse one instance.

    - #### getGenerator

          public static ECPoint getGenerator(ECCurve curve)

      Returns:
        the standard generator G1 of the prime-order subgroup, on the given curve instance (must be an instance returned by `createCurve()`).

    - #### constantTimeMultiply

          public static ECPoint constantTimeMultiply(ECPoint p,
                                                     java.math.BigInteger scalar)

      Constant-time scalar multiplication on G1, suitable for secret scalars (e.g. `sk * G1_gen` in `skToPk`).

      Same approach as `BLS12_381G2Point.constantTimeMultiply(java.math.BigInteger)`: a fixed-iteration "double, conditionally add" ladder over 256 bits with an array-indexed select replacing the bit-conditional `if`. Same caveats apply — the underlying BC ECPoint arithmetic still has data-dependent branches for infinity / equal-x cases (negligibly probable for random secret scalars on a prime-order subgroup), and JVM-level timing variance is not addressable in pure Java.