org.bouncycastle.crypto.bls

Class BLS12_381G2Point

java.lang.Object

org.bouncycastle.crypto.bls.BLS12_381G2Point

public final class BLS12_381G2Point
extends java.lang.Object

Affine point on the BLS12-381 G2 curve E: y^2 = x^3 + 4*(1+I) over Fp^2.

Affine coordinates with each operation normalising via Fp2Element.inverse().

Two scalar-multiplication APIs are provided: multiply(java.math.BigInteger) is the variable-time double-and-add — fast for public scalars (cofactor clearing, subgroup checks) but unsafe for secret scalars; and constantTimeMultiply(java.math.BigInteger) is a fixed-iteration ladder for use with secret scalars (e.g. sk * H(msg) in BLS sign).

Field Summary

Fields

Modifier and Type	Field and Description
static Fp2Element	B B coefficient: 4 * (1 + I).
static BLS12_381G2Point	INFINITY The point at infinity (identity element).

Method Summary

Modifier and Type	Method and Description
BLS12_381G2Point	add(BLS12_381G2Point other)
BLS12_381G2Point	constantTimeMultiply(java.math.BigInteger scalar) Constant-time scalar multiplication, suitable for secret scalars (e.g.
BLS12_381G2Point	doublePoint()
boolean	equals(java.lang.Object other)
int	hashCode()
boolean	isInfinity()
BLS12_381G2Point	multiply(java.math.BigInteger scalar) Variable-time double-and-add scalar multiplication.
BLS12_381G2Point	negate()
static BLS12_381G2Point	of(Fp2Element x, Fp2Element y) Constructs a G2 point from affine coordinates and verifies that (x, y) satisfies the curve equation y^2 = x^3 + 4*(1+I).
java.lang.String	toString()
Fp2Element	x()
Fp2Element	y()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Detail

B

public static final Fp2Element B

B coefficient: 4 * (1 + I).

INFINITY

public static final BLS12_381G2Point INFINITY

The point at infinity (identity element).

Method Detail

of

public static BLS12_381G2Point of(Fp2Element x,
                                  Fp2Element y)

Constructs a G2 point from affine coordinates and verifies that (x, y) satisfies the curve equation y^2 = x^3 + 4*(1+I).

isInfinity

public boolean isInfinity()

x

public Fp2Element x()

y

public Fp2Element y()

negate

public BLS12_381G2Point negate()

add

public BLS12_381G2Point add(BLS12_381G2Point other)

doublePoint

public BLS12_381G2Point doublePoint()

constantTimeMultiply

public BLS12_381G2Point constantTimeMultiply(java.math.BigInteger scalar)

Constant-time scalar multiplication, suitable for secret scalars (e.g. sk * H(msg) in BLS sign).

Uses a fixed-iteration "double, conditionally add" ladder over 256 bits, with the conditional-add implemented as an array-indexed select rather than an if. Both branches of every iteration compute the same set of point operations regardless of the scalar-bit value, so the per-bit timing does not depend on the scalar.

Caveats. "Constant-time" here means the scalar-bit-pattern-independent at the scalar-mult loop level. The underlying affine point ops still have data-dependent branches for infinity / equal-x cases (which are negligibly probable for random secret scalars on a prime-order subgroup), and the JVM itself may introduce cache / GC / JIT timing variance that pure Java cannot fully eliminate. Sufficient against a remote network timing attacker on a typical workload; not a substitute for a constant-time native implementation against a co-located adversary with cache-line resolution.

multiply

public BLS12_381G2Point multiply(java.math.BigInteger scalar)

Variable-time double-and-add scalar multiplication. Suitable for non-secret scalars (e.g. cofactor clearing); not safe for secret scalar use — see constantTimeMultiply(java.math.BigInteger).

equals

public boolean equals(java.lang.Object other)

Overrides:

equals in class java.lang.Object

hashCode

public int hashCode()

Overrides:

hashCode in class java.lang.Object

toString

public java.lang.String toString()

Overrides:

toString in class java.lang.Object