org.bouncycastle.crypto.bls (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

# Package org.bouncycastle.crypto.bls

BLS signatures over the BLS12-381 curve, per draft-irtf-cfrg-bls-signature.

See: Description

- Class Summary
  Class | Description
  --- | ---
  BLS12_381Aggregation | Helper for aggregating BLS12-381 signatures and verifying aggregates.
  BLS12_381BasicScheme | BLS signatures BasicScheme over BLS12-381, per draft-irtf-cfrg-bls-signature (variant: public keys in G1, signatures in G2; suite `BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_`).
  BLS12_381G1 | Curve parameters for BLS12-381 G1, the prime-order subgroup of `E(Fp)` defined by `y^2 = x^3 + 4` over `Fp`, as standardised in draft-irtf-cfrg-bls-signature and RFC 9380 sec. 8.8.1.
  BLS12_381G2 | Curve parameters for BLS12-381 G2, the prime-order subgroup of `E(Fp^2)` defined by `y^2 = x^3 + 4 * (1 + I)` over Fp^2.
  BLS12_381G2HashToCurve | Implementation of the BLS12381G2_XMD:SHA-256_SSWU_RO_ hash-to-curve suite (RFC 9380 sec. 8.8.2): a deterministic, uniform map from a byte string and a domain-separation tag to a point in the BLS12-381 G2 prime-order subgroup.
  BLS12_381G2Point | Affine point on the BLS12-381 G2 curve `E: y^2 = x^3 + 4*(1+I)` over Fp^2.
  BLS12_381MessageAugmentation | BLS signatures MessageAugmentation suite over BLS12-381, per draft-irtf-cfrg-bls-signature: signature suite `BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_AUG_`.
  BLS12_381Pairing | Optimal ate pairing on BLS12-381: a bilinear, non-degenerate map `e: G1 x G2 -> GT` where GT is the order-r subgroup of Fp^12 ^*.
  BLS12_381ProofOfPossession | BLS signatures ProofOfPossession suite over BLS12-381, per draft-irtf-cfrg-bls-signature: signature suite `BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_` together with a separate proof-of-possession message that uses the `BLS_POP_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_` DST.
  BLS12_381Serialization | Zcash-format compressed point serialization for BLS12-381 G1 and G2, matching the encoding used by Zcash, Eth2, Filecoin, and the IETF pairing-friendly-curves draft.
  BLS12_381SubgroupCheck | Fast subgroup-membership tests for BLS12-381 G1 and G2, replacing the naive `[r] * P == 0` scalar multiplication (255-bit).
  Fp12Element | Immutable element of `Fp^12 = Fp^6[w] / (w^2 - v)`, the outer level of the BLS12-381 pairing field tower.
  Fp2Element | Immutable element of `Fp^2 = Fp[I] / (I^2 + 1)`, used as the base field of BLS12-381 G2.
  Fp6Element | Immutable element of `Fp^6 = Fp^2[v] / (v^3 - (1 + I))`, the cubic extension of `Fp2Element` used as the inner level of the BLS12-381 pairing field tower.

## Package org.bouncycastle.crypto.bls Description

BLS signatures over the BLS12-381 curve, per draft-irtf-cfrg-bls-signature.

The three ciphersuite variants are provided as static-API classes — `BLS12_381BasicScheme`, `BLS12_381MessageAugmentation` and `BLS12_381ProofOfPossession` — with a BC-conventional signer / key-pair generator surface alongside in `org.bouncycastle.crypto.signers` (`BLSSigner`) and `org.bouncycastle.crypto.generators` (`BLSKeyPairGenerator`). Keys and signatures use the compressed Zcash point encoding (48-byte G1 public keys, 96-byte G2 signatures).