ECSchnorrZKP (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.agreement.owl

## Class ECSchnorrZKP

- java.lang.Object
- - org.bouncycastle.crypto.agreement.owl.ECSchnorrZKP

-     public class ECSchnorrZKP
      extends java.lang.Object

  Schnorr non-interactive zero-knowledge proof over an elliptic curve, as used in the Owl key exchange. The {(V, r)} pair follows the RFC 8235 §3.2 EC-Schnorr-Signature encoding: prover picks ephemeral v in [1, n-1], publishes commitment V = [v]G alongside response r = v - d*c mod n, where d is the prover's private key and c is the challenge hash. The verifier recomputes c and checks V == [r]G + [c]X.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `ECSchnorrZKP(ECPoint V, java.math.BigInteger r)` Constructor for ECSchnorrZKP

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `java.math.BigInteger` | `getr()` Get the prover's response r to the challenge c, r = v - d * c mod n where d is the prover's private key
    `ECPoint` | `getV()` Get the prover's commitment V = G x [v] where G is a base point on the elliptic curve and v is an ephemeral secret

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### ECSchnorrZKP

          public ECSchnorrZKP(ECPoint V,
                              java.math.BigInteger r)

      Constructor for ECSchnorrZKP
      Parameters:
        `V` - Prover's commitment V = G x [v]
        `r` - Prover's response r to a challenge c, r = v - d * c mod n

  - ### Method Detail

    - #### getV

          public ECPoint getV()

      Get the prover's commitment V = G x [v] where G is a base point on the elliptic curve and v is an ephemeral secret
      Returns:
        The prover's commitment

    - #### getr

          public java.math.BigInteger getr()

      Get the prover's response r to the challenge c, r = v - d * c mod n where d is the prover's private key
      Returns:
        The prover's response