BLS12_381Serialization (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.bls

## Class BLS12_381Serialization

- java.lang.Object
- - org.bouncycastle.crypto.bls.BLS12_381Serialization

-     public class BLS12_381Serialization
      extends java.lang.Object

  Zcash-format compressed point serialization for BLS12-381 G1 and G2, matching the encoding used by Zcash, Eth2, Filecoin, and the IETF pairing-friendly-curves draft.

  G1 compressed encoding is 48 bytes; G2 compressed encoding is 96 bytes. The high three bits of the first byte are flags:

  - bit 7 (0x80): compressed (always set in this format)
  - bit 6 (0x40): infinity (set iff this is the point at infinity)
  - bit 5 (0x20): y-sign (set iff y > -y in the encoded byte order)
  Because BLS12-381 Fp is 381 bits, the x-coordinate big-endian bytes have three free top bits, which is where the flag bits live. For Fp² coordinates, Zcash convention orders `(c1, c0)` — the imaginary part first.

  The y-sign flag uses the lexicographic ordering of the encoded `y` versus `-y`: for Fp this reduces to `y > (p-1)/2`, for Fp² to "`y.c1 > (p-1)/2`, or `y.c0 > (p-1)/2` when `y.c1 == 0`".

  Decompression validates the curve equation and the flag combinations but does not perform a prime-order subgroup check — callers that need a `validated` public key or a subgroup-checked signature should do that explicitly.

- - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static byte[]` | `compressG1(ECPoint point)` Compress a G1 point to its 48-byte Zcash-format encoding.
    `static byte[]` | `compressG2(BLS12_381G2Point point)` Compress a G2 point to its 96-byte Zcash-format encoding.
    `static ECPoint` | `decompressG1(byte[] bytes, ECCurve curve)` Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve.
    `static BLS12_381G2Point` | `decompressG2(byte[] bytes)` Decompress a 96-byte Zcash-format encoding back to a G2 point.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Method Detail

    - #### compressG1

          public static byte[] compressG1(ECPoint point)

      Compress a G1 point to its 48-byte Zcash-format encoding.

    - #### decompressG1

          public static ECPoint decompressG1(byte[] bytes,
                                             ECCurve curve)

      Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve. Validates the flag combinations and the curve equation; does not subgroup-check.

    - #### compressG2

          public static byte[] compressG2(BLS12_381G2Point point)

      Compress a G2 point to its 96-byte Zcash-format encoding.

    - #### decompressG2

          public static BLS12_381G2Point decompressG2(byte[] bytes)

      Decompress a 96-byte Zcash-format encoding back to a G2 point. Validates the flag combinations, that the recovered x is in Fp², and that `(x, y)` satisfies the G2 curve equation; does not subgroup-check.