org.bouncycastle.crypto.hash2curve.test

Class BLS12_381ConstantTimeMulTest

java.lang.Object

junit.framework.Assert

junit.framework.TestCase

org.bouncycastle.crypto.hash2curve.test.BLS12_381ConstantTimeMulTest

All Implemented Interfaces:

junit.framework.Test

public class BLS12_381ConstantTimeMulTest
extends junit.framework.TestCase

Tests for the constant-time scalar-multiplication paths used by BLS sign / skToPk on secret scalars.

The strongest correctness check is "constantTimeMultiply produces the same result as the variable-time multiply for every test scalar" — algebraic equivalence rules out any chance that the timing-protection rewrite changed the output. Combined with the Eth2 byte-level KAT tests (which exercise the constant-time path end-to-end), this gives strong evidence the constant-time variants are correct as well as timing-protected.

A coarse timing-stability check is included as a smoke test, with the caveat that pure-Java timing measurement is noisy and a crude inter-run variance check is the best we can do without a JMH harness.

Constructor Summary

Constructors

Constructor and Description
BLS12_381ConstantTimeMulTest()

Method Summary

Modifier and Type	Method and Description
void	testG1EquivalenceOnRandomScalars()
void	testG1EquivalenceOnSmallScalars()
void	testG1InfinityPoint()
void	testG2ConstantTimeSmokeCheck() Coarse timing-stability smoke test — for any two scalars of the same bit length the constant-time multiply should take comparable time.
void	testG2EquivalenceOnLowAndHighHammingWeight()
void	testG2EquivalenceOnRandomScalars()
void	testG2EquivalenceOnSmallScalars()
void	testG2InfinityPoint()
void	testG2InfinityScalar()
void	testG2NegativeScalar()

Methods inherited from class junit.framework.TestCase

assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, countTestCases, createResult, fail, fail, failNotEquals, failNotSame, failSame, format, getName, run, run, runBare, runTest, setName, setUp, tearDown, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

BLS12_381ConstantTimeMulTest

public BLS12_381ConstantTimeMulTest()

Method Detail

testG2EquivalenceOnSmallScalars

public void testG2EquivalenceOnSmallScalars()

testG2EquivalenceOnRandomScalars

public void testG2EquivalenceOnRandomScalars()

testG2EquivalenceOnLowAndHighHammingWeight

public void testG2EquivalenceOnLowAndHighHammingWeight()

testG2InfinityScalar

public void testG2InfinityScalar()

testG2NegativeScalar

public void testG2NegativeScalar()

testG2InfinityPoint

public void testG2InfinityPoint()

testG1EquivalenceOnSmallScalars

public void testG1EquivalenceOnSmallScalars()

testG1EquivalenceOnRandomScalars

public void testG1EquivalenceOnRandomScalars()

testG1InfinityPoint

public void testG1InfinityPoint()

testG2ConstantTimeSmokeCheck

public void testG2ConstantTimeSmokeCheck()

Coarse timing-stability smoke test — for any two scalars of the same bit length the constant-time multiply should take comparable time. Specifically, low-Hamming-weight (worst case for vanilla double-and-add) and high-Hamming-weight should be within a small factor of each other. We don't assert tight bounds because Java timing is noisy (JIT, GC, cache); we just assert they're not > 5x apart, which would indicate a very obvious bit-pattern leak.