BLS12_381BasicScheme (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.bls

## Class BLS12_381BasicScheme

- java.lang.Object
- - org.bouncycastle.crypto.bls.BLS12_381BasicScheme

-     public class BLS12_381BasicScheme
      extends java.lang.Object

  BLS signatures BasicScheme over BLS12-381, per draft-irtf-cfrg-bls-signature (variant: public keys in G1, signatures in G2; suite `BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_`).

  Provides the algorithmic core: KeyGen, SkToPk, Sign, Verify, KeyValidate, and aggregate verification. The static API operates on in-memory math objects (`BigInteger` secret keys, `ECPoint` public keys, byte-array messages, `BLS12_381G2Point` signatures); `BLS12_381Serialization` converts to and from the spec's Zcash-format compressed encodings.

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static byte[]` | `DST` Domain-separation tag for hash-to-curve under the BasicScheme suite.

  - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static boolean` | `aggregateVerify(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg)` Aggregate verification under the BasicScheme.
    `static java.math.BigInteger` | `keyGen(byte[] ikm, byte[] keyInfo)` Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.
    `static boolean` | `keyValidate(ECPoint pk)` Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.
    `static BLS12_381G2Point` | `sign(java.math.BigInteger sk, byte[] message)` Sign a message under the BasicScheme: `sig = sk * H(message)` where `H` is hash-to-G2 with the suite's DST.
    `static ECPoint` | `skToPk(java.math.BigInteger sk)` Derive the public key for a given secret key: `PK = sk * G1_gen`.
    `static boolean` | `verify(ECPoint pk, byte[] message, BLS12_381G2Point signature)` Verify a BasicScheme signature.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### DST

          public static final byte[] DST

      Domain-separation tag for hash-to-curve under the BasicScheme suite.

  - ### Method Detail

    - #### keyGen

          public static java.math.BigInteger keyGen(byte[] ikm,
                                                    byte[] keyInfo)

      Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.

      Same `(ikm, keyInfo)` input always produces the same secret key, so `ikm` should come from a high-entropy source the caller controls (e.g. `SecureRandom.nextBytes`).

      Parameters:
        `ikm` - input keying material; the spec requires at least 32 bytes.
        `keyInfo` - optional context binding; pass an empty array if not used.
      Returns:
        a secret key `0 < sk < r`.

    - #### skToPk

          public static ECPoint skToPk(java.math.BigInteger sk)

      Derive the public key for a given secret key: `PK = sk * G1_gen`.

    - #### keyValidate

          public static boolean keyValidate(ECPoint pk)

      Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.

    - #### sign

          public static BLS12_381G2Point sign(java.math.BigInteger sk,
                                              byte[] message)

      Sign a message under the BasicScheme: `sig = sk * H(message)` where `H` is hash-to-G2 with the suite's DST.

    - #### verify

          public static boolean verify(ECPoint pk,
                                       byte[] message,
                                       BLS12_381G2Point signature)

      Verify a BasicScheme signature. Returns `true` iff `pk` is a valid G1 point in the prime-order subgroup, `signature` is a valid G2 point in the prime-order subgroup, and the pairing equation `e(G1_gen, sig) == e(pk, H(message))` holds.

    - #### aggregateVerify

          public static boolean aggregateVerify(ECPoint[] pks,
                                                byte[][] messages,
                                                BLS12_381G2Point sigAgg)

      Aggregate verification under the BasicScheme. Per draft-irtf-cfrg-bls-signature sec. 3.1.1, the messages must all be distinct — otherwise an attacker holding sk_1 and a victim public key pk_2 can forge an aggregate by setting sig_1 = sk_1*H(m), sig_2 arbitrary such that sig_1 + sig_2 cancels into a known value. The MessageAugmentation and ProofOfPossession suites avoid this requirement structurally; this BasicScheme variant enforces it.