org.bouncycastle.crypto.bls

Class BLS12_381BasicScheme

java.lang.Object

org.bouncycastle.crypto.bls.BLS12_381BasicScheme

public class BLS12_381BasicScheme
extends java.lang.Object

BLS signatures BasicScheme over BLS12-381, per draft-irtf-cfrg-bls-signature (variant: public keys in G1, signatures in G2; suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_).

Provides the algorithmic core: KeyGen, SkToPk, Sign, Verify, KeyValidate, and aggregate verification. The static API operates on in-memory math objects (BigInteger secret keys, ECPoint public keys, byte-array messages, BLS12_381G2Point signatures); BLS12_381Serialization converts to and from the spec's Zcash-format compressed encodings.

Field Summary

Fields

Modifier and Type	Field and Description
static byte[]	DST Domain-separation tag for hash-to-curve under the BasicScheme suite.

Method Summary

Modifier and Type	Method and Description
static boolean	aggregateVerify(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg) Aggregate verification under the BasicScheme.
static java.math.BigInteger	keyGen(byte[] ikm, byte[] keyInfo) Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.
static boolean	keyValidate(ECPoint pk) Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.
static BLS12_381G2Point	sign(java.math.BigInteger sk, byte[] message) Sign a message under the BasicScheme: sig = sk * H(message) where H is hash-to-G2 with the suite's DST.
static ECPoint	skToPk(java.math.BigInteger sk) Derive the public key for a given secret key: PK = sk * G1_gen.
static boolean	verify(ECPoint pk, byte[] message, BLS12_381G2Point signature) Verify a BasicScheme signature.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DST

public static final byte[] DST

Domain-separation tag for hash-to-curve under the BasicScheme suite.

Method Detail

keyGen

public static java.math.BigInteger keyGen(byte[] ikm,
                                          byte[] keyInfo)

Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.

Same (ikm, keyInfo) input always produces the same secret key, so ikm should come from a high-entropy source the caller controls (e.g. SecureRandom.nextBytes).

Parameters:

ikm - input keying material; the spec requires at least 32 bytes.

keyInfo - optional context binding; pass an empty array if not used.

Returns:

a secret key 0 < sk < r.

skToPk

public static ECPoint skToPk(java.math.BigInteger sk)

Derive the public key for a given secret key: PK = sk * G1_gen.

keyValidate

public static boolean keyValidate(ECPoint pk)

Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.

sign

public static BLS12_381G2Point sign(java.math.BigInteger sk,
                                    byte[] message)

Sign a message under the BasicScheme: sig = sk * H(message) where H is hash-to-G2 with the suite's DST.

verify

public static boolean verify(ECPoint pk,
                             byte[] message,
                             BLS12_381G2Point signature)

Verify a BasicScheme signature. Returns true iff pk is a valid G1 point in the prime-order subgroup, signature is a valid G2 point in the prime-order subgroup, and the pairing equation e(G1_gen, sig) == e(pk, H(message)) holds.

aggregateVerify

public static boolean aggregateVerify(ECPoint[] pks,
                                      byte[][] messages,
                                      BLS12_381G2Point sigAgg)

Aggregate verification under the BasicScheme. Per draft-irtf-cfrg-bls-signature sec. 3.1.1, the messages must all be distinct — otherwise an attacker holding sk_1 and a victim public key pk_2 can forge an aggregate by setting sig_1 = sk_1*H(m), sig_2 arbitrary such that sig_1 + sig_2 cancels into a known value. The MessageAugmentation and ProofOfPossession suites avoid this requirement structurally; this BasicScheme variant enforces it.