Class BLS12_381G1

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381G1
public class BLS12_381G1 extends Object
Curve parameters for BLS12-381 G1, the prime-order subgroup of E(Fp) defined by y^2 = x^3 + 4 over Fp, as standardised in draft-irtf-cfrg-bls-signature and RFC 9380 sec. 8.8.1.

The curve is exposed via the standard ECCurve.Fp (BigInteger-backed) so that hash-to-curve and other G1-only consumers can be built on top without depending on a custom limb-array representation.

  • Field Details

    • Q

      public static final BigInteger Q
      Base field characteristic p. 381 bits.

    • ORDER

      public static final BigInteger ORDER
      G1 prime-order subgroup order r. 255 bits.

    • COFACTOR

      public static final BigInteger COFACTOR
      G1 cofactor h.

    • H_EFF

      public static final BigInteger H_EFF
      Effective cofactor for hash-to-curve (RFC 9380 sec. 8.8.1): h_eff = 1 - x where x = -0xd201000000010000 is the BLS12-381 trace parameter, so h_eff = 0xd201000000010001. Multiplying any point on E(Fp) by h_eff lands in the prime-order subgroup; this is faster than the full cofactor multiplication and is the form mandated by the hash-to-curve suite.

  • Method Details

    • createCurve

      public static ECCurve createCurve()
      Returns:
      a fresh ECCurve instance for BLS12-381 G1 (y^2 = x^3 + 4 over Fp). Each call returns an independent curve; consumers that build derived structures (auxiliary isogeny curves, lookup tables, etc.) should reuse one instance.

    • getGenerator

      public static ECPoint getGenerator(ECCurve curve)
      Returns:
      the standard generator G1 of the prime-order subgroup, on the given curve instance (must be an instance returned by createCurve()).

    • constantTimeMultiply

      public static ECPoint constantTimeMultiply(ECPoint p, BigInteger scalar)
      Constant-time scalar multiplication on G1, suitable for secret scalars (e.g. sk * G1_gen in skToPk).

      Same approach as BLS12_381G2Point.constantTimeMultiply(BigInteger): a fixed-iteration "double, conditionally add" ladder over 256 bits with an array-indexed select replacing the bit-conditional if. Same caveats apply — the underlying BC ECPoint arithmetic still has data-dependent branches for infinity / equal-x cases (negligibly probable for random secret scalars on a prime-order subgroup), and JVM-level timing variance is not addressable in pure Java.