BLS12_381MessageAugmentation (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.bls

## Class BLS12_381MessageAugmentation

- java.lang.Object
- - org.bouncycastle.crypto.bls.BLS12_381MessageAugmentation

-     public class BLS12_381MessageAugmentation
      extends java.lang.Object

  BLS signatures MessageAugmentation suite over BLS12-381, per draft-irtf-cfrg-bls-signature: signature suite `BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_AUG_`.

  Differs from `BLS12_381BasicScheme` by prepending the public-key encoding to the message before hashing. The augmentation defends against rogue-key attacks in aggregate-verification without the standalone proof-of-possession step that `BLS12_381ProofOfPossession` requires.

  The public-key prefix used in the hash-to-curve input is the Zcash-format 48-byte compressed G1 encoding produced by `BLS12_381Serialization.compressG1(org.bouncycastle.math.ec.ECPoint)`, matching draft-irtf-cfrg-bls-signature's `point_to_pubkey` so signatures are potentially interoperable with other BLS implementations once verified against published test vectors.

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static byte[]` | `DST`

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static boolean` | `aggregateVerify(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg)` Aggregate verification under the MessageAugmentation suite.
    `static BLS12_381G2Point` | `sign(java.math.BigInteger sk, byte[] message)` Sign under the MessageAugmentation suite: `sig = sk * H(SkToPk(sk) || message)` with the AUG DST.
    `static boolean` | `verify(ECPoint pk, byte[] message, BLS12_381G2Point signature)` Verify under the MessageAugmentation suite.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### DST

          public static final byte[] DST

  - ### Method Detail

    - #### sign

          public static BLS12_381G2Point sign(java.math.BigInteger sk,
                                              byte[] message)

      Sign under the MessageAugmentation suite: `sig = sk * H(SkToPk(sk) || message)` with the AUG DST.

    - #### verify

          public static boolean verify(ECPoint pk,
                                       byte[] message,
                                       BLS12_381G2Point signature)

      Verify under the MessageAugmentation suite. Returns `true` iff `pk` is a valid prime-order G1 point, `signature` is a valid prime-order G2 point, and the pairing equation `e(G1_gen, sig) == e(pk, H(pk || message))` holds.

    - #### aggregateVerify

          public static boolean aggregateVerify(ECPoint[] pks,
                                                byte[][] messages,
                                                BLS12_381G2Point sigAgg)

      Aggregate verification under the MessageAugmentation suite. Distinct messages are not required: the augmentation makes each `H(pk_i || msg_i)` input unique even when the `msg_i` repeat.