org.bouncycastle.crypto.bls

Class BLS12_381G1

java.lang.Object

org.bouncycastle.crypto.bls.BLS12_381G1

public class BLS12_381G1
extends java.lang.Object

Curve parameters for BLS12-381 G1, the prime-order subgroup of E(Fp) defined by y^2 = x^3 + 4 over Fp, as standardised in draft-irtf-cfrg-bls-signature and RFC 9380 sec. 8.8.1.

The curve is exposed via the standard ECCurve.Fp (BigInteger-backed) so that hash-to-curve and other G1-only consumers can be built on top without depending on a custom limb-array representation.

Field Summary

Fields

Modifier and Type	Field and Description
static java.math.BigInteger	COFACTOR G1 cofactor h.
static java.math.BigInteger	H_EFF Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): h_eff = 1 - x where x = -0xd201000000010000 is the BLS12-381 trace parameter, so h_eff = 0xd201000000010001.
static java.math.BigInteger	ORDER G1 prime-order subgroup order r. 255 bits.
static java.math.BigInteger	Q Base field characteristic p. 381 bits.

Method Summary

Modifier and Type	Method and Description
static ECPoint	constantTimeMultiply(ECPoint p, java.math.BigInteger scalar) Constant-time scalar multiplication on G1, suitable for secret scalars (e.g.
static ECCurve	createCurve()
static ECPoint	getGenerator(ECCurve curve)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

Q

public static final java.math.BigInteger Q

Base field characteristic p. 381 bits.

ORDER

public static final java.math.BigInteger ORDER

G1 prime-order subgroup order r. 255 bits.

COFACTOR

public static final java.math.BigInteger COFACTOR

G1 cofactor h.

H_EFF

public static final java.math.BigInteger H_EFF

Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): h_eff = 1 - x where x = -0xd201000000010000 is the BLS12-381 trace parameter, so h_eff = 0xd201000000010001. Multiplying any point on E(Fp) by h_eff lands in the prime-order subgroup; this is faster than the full cofactor multiplication and is the form mandated by the hash-to-curve suite.

Method Detail

createCurve

public static ECCurve createCurve()

Returns:

a fresh ECCurve instance for BLS12-381 G1 (y^2 = x^3 + 4 over Fp). Each call returns an independent curve; consumers that build derived structures (auxiliary isogeny curves, lookup tables, etc.) should reuse one instance.

getGenerator

public static ECPoint getGenerator(ECCurve curve)

Returns:

the standard generator G1 of the prime-order subgroup, on the given curve instance (must be an instance returned by createCurve()).

constantTimeMultiply

public static ECPoint constantTimeMultiply(ECPoint p,
                                           java.math.BigInteger scalar)

Constant-time scalar multiplication on G1, suitable for secret scalars (e.g. sk * G1_gen in skToPk).

Same approach as BLS12_381G2Point.constantTimeMultiply(java.math.BigInteger): a fixed-iteration "double, conditionally add" ladder over 256 bits with an array-indexed select replacing the bit-conditional if. Same caveats apply — the underlying BC ECPoint arithmetic still has data-dependent branches for infinity / equal-x cases (negligibly probable for random secret scalars on a prime-order subgroup), and JVM-level timing variance is not addressable in pure Java.