BLS12_381G2HashToCurve (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.bls

## Class BLS12_381G2HashToCurve

- java.lang.Object
- - org.bouncycastle.crypto.bls.BLS12_381G2HashToCurve

-     public class BLS12_381G2HashToCurve
      extends java.lang.Object

  Implementation of the BLS12381G2_XMD:SHA-256_SSWU_RO_ hash-to-curve suite (RFC 9380 sec. 8.8.2): a deterministic, uniform map from a byte string and a domain-separation tag to a point in the BLS12-381 G2 prime-order subgroup.

  Pipeline:

  1. `expand_message_xmd(msg, dst, 256)` produces 256 bytes (count=2, m=2, L=64).
  2. The bytes are split into two Fp^2 elements u[0], u[1].
  3. Each is run through SSWU on the 3-isogenous helper curve E' (with A' = 240*I, B' = 1012*(1+I), Z = -(2+I)).
  4. The results are mapped to E by the iso_3 rational map (RFC 9380 App. E.3).
  5. The two G2 points are added, and the cofactor is cleared by scalar-multiplication by h_eff.

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `BLS12_381G2HashToCurve(byte[] dst)`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `BLS12_381G2Point` | `hashToCurve(byte[] message)`
    `Fp2Element[]` | `hashToField(byte[] message)` Stage 1: expands `message` into two Fp² field elements per RFC 9380 sec. 5.3.
    `BLS12_381G2Point` | `mapToCurveAndIso3(Fp2Element u)` Stages 2-3: simplified SWU on E' followed by iso_3 to E.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### BLS12_381G2HashToCurve

          public BLS12_381G2HashToCurve(byte[] dst)

  - ### Method Detail

    - #### hashToCurve

          public BLS12_381G2Point hashToCurve(byte[] message)

    - #### hashToField

          public Fp2Element[] hashToField(byte[] message)

      Stage 1: expands `message` into two Fp² field elements per RFC 9380 sec. 5.3. Exposed for layered testing and for callers that want the raw field elements without the curve mapping.

    - #### mapToCurveAndIso3

          public BLS12_381G2Point mapToCurveAndIso3(Fp2Element u)

      Stages 2-3: simplified SWU on E' followed by iso_3 to E. Exposed for layered testing; returns a point on E that has not yet had its cofactor cleared, so it is generally not in the prime-order subgroup.