Class BLS12_381G2HashToCurve

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381G2HashToCurve
public class BLS12_381G2HashToCurve extends Object
Implementation of the BLS12381G2_XMD:SHA-256_SSWU_RO_ hash-to-curve suite (RFC 9380 sec. 8.8.2): a deterministic, uniform map from a byte string and a domain-separation tag to a point in the BLS12-381 G2 prime-order subgroup.

Pipeline:

  1. expand_message_xmd(msg, dst, 256) produces 256 bytes (count=2, m=2, L=64).
  2. The bytes are split into two Fp^2 elements u[0], u[1].
  3. Each is run through SSWU on the 3-isogenous helper curve E' (with A' = 240*I, B' = 1012*(1+I), Z = -(2+I)).
  4. The results are mapped to E by the iso_3 rational map (RFC 9380 App. E.3).
  5. The two G2 points are added, and the cofactor is cleared by scalar-multiplication by h_eff.

  • Constructor Details

    • BLS12_381G2HashToCurve

      public BLS12_381G2HashToCurve(byte[] dst)

  • Method Details

    • hashToCurve

      public BLS12_381G2Point hashToCurve(byte[] message)

    • hashToField

      public Fp2Element[] hashToField(byte[] message)
      Stage 1: expands message into two Fp² field elements per RFC 9380 sec. 5.3. Exposed for layered testing and for callers that want the raw field elements without the curve mapping.

    • mapToCurveAndIso3

      public BLS12_381G2Point mapToCurveAndIso3(Fp2Element u)
      Stages 2-3: simplified SWU on E' followed by iso_3 to E. Exposed for layered testing; returns a point on E that has not yet had its cofactor cleared, so it is generally not in the prime-order subgroup.