Class BLS12_381BasicScheme

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381BasicScheme
public class BLS12_381BasicScheme extends Object
BLS signatures BasicScheme over BLS12-381, per draft-irtf-cfrg-bls-signature (variant: public keys in G1, signatures in G2; suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_).

Provides the algorithmic core: KeyGen, SkToPk, Sign, Verify, KeyValidate, and aggregate verification. The static API operates on in-memory math objects (BigInteger secret keys, ECPoint public keys, byte-array messages, BLS12_381G2Point signatures); BLS12_381Serialization converts to and from the spec's Zcash-format compressed encodings.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final byte[]
    DST
    Domain-separation tag for hash-to-curve under the BasicScheme suite.

  • Method Summary

    Modifier and Type
    Method
    Description
    static boolean
    aggregateVerify(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg)
    Aggregate verification under the BasicScheme.
    static BigInteger
    keyGen(byte[] ikm, byte[] keyInfo)
    Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.
    static boolean
    keyValidate(ECPoint pk)
    Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.
    static BLS12_381G2Point
    sign(BigInteger sk, byte[] message)
    Sign a message under the BasicScheme: sig = sk * H(message) where H is hash-to-G2 with the suite's DST.
    static ECPoint
    skToPk(BigInteger sk)
    Derive the public key for a given secret key: PK = sk * G1_gen.
    static boolean
    verify(ECPoint pk, byte[] message, BLS12_381G2Point signature)
    Verify a BasicScheme signature.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • DST

      public static final byte[] DST
      Domain-separation tag for hash-to-curve under the BasicScheme suite.

  • Method Details

    • keyGen

      public static BigInteger keyGen(byte[] ikm, byte[] keyInfo)
      Derive a secret key from input keying material per draft-irtf-cfrg-bls-signature sec. 2.3.

      Same (ikm, keyInfo) input always produces the same secret key, so ikm should come from a high-entropy source the caller controls (e.g. SecureRandom.nextBytes).

      Parameters:
      ikm - input keying material; the spec requires at least 32 bytes.
      keyInfo - optional context binding; pass an empty array if not used.
      Returns:
      a secret key 0 < sk < r.

    • skToPk

      public static ECPoint skToPk(BigInteger sk)
      Derive the public key for a given secret key: PK = sk * G1_gen.

    • keyValidate

      public static boolean keyValidate(ECPoint pk)
      Validate a public key per draft-irtf-cfrg-bls-signature sec. 2.5: non-identity, on the G1 curve, and in the prime-order subgroup.

    • sign

      public static BLS12_381G2Point sign(BigInteger sk, byte[] message)
      Sign a message under the BasicScheme: sig = sk * H(message) where H is hash-to-G2 with the suite's DST.

    • verify

      public static boolean verify(ECPoint pk, byte[] message, BLS12_381G2Point signature)
      Verify a BasicScheme signature. Returns true iff pk is a valid G1 point in the prime-order subgroup, signature is a valid G2 point in the prime-order subgroup, and the pairing equation e(G1_gen, sig) == e(pk, H(message)) holds.

    • aggregateVerify

      public static boolean aggregateVerify(ECPoint[] pks, byte[][] messages, BLS12_381G2Point sigAgg)
      Aggregate verification under the BasicScheme. Per draft-irtf-cfrg-bls-signature sec. 3.1.1, the messages must all be distinct — otherwise an attacker holding sk_1 and a victim public key pk_2 can forge an aggregate by setting sig_1 = sk_1*H(m), sig_2 arbitrary such that sig_1 + sig_2 cancels into a known value. The MessageAugmentation and ProofOfPossession suites avoid this requirement structurally; this BasicScheme variant enforces it.