BLS12_381G2Point (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.bls

## Class BLS12_381G2Point

- java.lang.Object
- - org.bouncycastle.crypto.bls.BLS12_381G2Point

-     public final class BLS12_381G2Point
      extends java.lang.Object

  Affine point on the BLS12-381 G2 curve `E: y^2 = x^3 + 4*(1+I)` over Fp^2.

  Affine coordinates with each operation normalising via `Fp2Element.inverse()`.

  Two scalar-multiplication APIs are provided: `multiply(java.math.BigInteger)` is the variable-time double-and-add — fast for public scalars (cofactor clearing, subgroup checks) but unsafe for secret scalars; and `constantTimeMultiply(java.math.BigInteger)` is a fixed-iteration ladder for use with secret scalars (e.g. `sk * H(msg)` in BLS sign).

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static Fp2Element` | `B` B coefficient: 4 * (1 + I).
    `static BLS12_381G2Point` | `INFINITY` The point at infinity (identity element).

  - ### Method Summary

    All Methods Static Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `BLS12_381G2Point` | `add(BLS12_381G2Point other)`
    `BLS12_381G2Point` | `constantTimeMultiply(java.math.BigInteger scalar)` Constant-time scalar multiplication, suitable for secret scalars (e.g.
    `BLS12_381G2Point` | `doublePoint()`
    `boolean` | `equals(java.lang.Object other)`
    `int` | `hashCode()`
    `boolean` | `isInfinity()`
    `BLS12_381G2Point` | `multiply(java.math.BigInteger scalar)` Variable-time double-and-add scalar multiplication.
    `BLS12_381G2Point` | `negate()`
    `static BLS12_381G2Point` | `of(Fp2Element x, Fp2Element y)` Constructs a G2 point from affine coordinates and verifies that `(x, y)` satisfies the curve equation `y^2 = x^3 + 4*(1+I)`.
    `java.lang.String` | `toString()`
    `Fp2Element` | `x()`
    `Fp2Element` | `y()`

    - ### Methods inherited from class java.lang.Object

      `clone, finalize, getClass, notify, notifyAll, wait, wait, wait`

- - ### Field Detail

    - #### B

          public static final Fp2Element B

      B coefficient: 4 * (1 + I).

    - #### INFINITY

          public static final BLS12_381G2Point INFINITY

      The point at infinity (identity element).

  - ### Method Detail

    - #### of

          public static BLS12_381G2Point of(Fp2Element x,
                                            Fp2Element y)

      Constructs a G2 point from affine coordinates and verifies that `(x, y)` satisfies the curve equation `y^2 = x^3 + 4*(1+I)`.

    - #### isInfinity

          public boolean isInfinity()

    - #### x

          public Fp2Element x()

    - #### y

          public Fp2Element y()

    - #### negate

          public BLS12_381G2Point negate()

    - #### add

          public BLS12_381G2Point add(BLS12_381G2Point other)

    - #### doublePoint

          public BLS12_381G2Point doublePoint()

    - #### constantTimeMultiply

          public BLS12_381G2Point constantTimeMultiply(java.math.BigInteger scalar)

      Constant-time scalar multiplication, suitable for secret scalars (e.g. `sk * H(msg)` in BLS sign).

      Uses a fixed-iteration "double, conditionally add" ladder over 256 bits, with the conditional-add implemented as an array-indexed select rather than an `if`. Both branches of every iteration compute the same set of point operations regardless of the scalar-bit value, so the per-bit timing does not depend on the scalar.

      Caveats. "Constant-time" here means the scalar-bit-pattern-independent at the scalar-mult loop level. The underlying affine point ops still have data-dependent branches for infinity / equal-x cases (which are negligibly probable for random secret scalars on a prime-order subgroup), and the JVM itself may introduce cache / GC / JIT timing variance that pure Java cannot fully eliminate. Sufficient against a remote network timing attacker on a typical workload; not a substitute for a constant-time native implementation against a co-located adversary with cache-line resolution.

    - #### multiply

          public BLS12_381G2Point multiply(java.math.BigInteger scalar)

      Variable-time double-and-add scalar multiplication. Suitable for non-secret scalars (e.g. cofactor clearing); not safe for secret scalar use — see `constantTimeMultiply(java.math.BigInteger)`.

    - #### equals

          public boolean equals(java.lang.Object other)

      Overrides:
        `equals` in class `java.lang.Object`

    - #### hashCode

          public int hashCode()

      Overrides:
        `hashCode` in class `java.lang.Object`

    - #### toString

          public java.lang.String toString()

      Overrides:
        `toString` in class `java.lang.Object`