Class BLS12_381G2Point

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381G2Point
public final class BLS12_381G2Point extends Object
Affine point on the BLS12-381 G2 curve E: y^2 = x^3 + 4*(1+I) over Fp^2.

Affine coordinates with each operation normalising via Fp2Element.inverse().

Two scalar-multiplication APIs are provided: multiply(BigInteger) is the variable-time double-and-add — fast for public scalars (cofactor clearing, subgroup checks) but unsafe for secret scalars; and constantTimeMultiply(BigInteger) is a fixed-iteration ladder for use with secret scalars (e.g. sk * H(msg) in BLS sign).

  • Field Details

    • B

      public static final Fp2Element B
      B coefficient: 4 * (1 + I).

    • INFINITY

      public static final BLS12_381G2Point INFINITY
      The point at infinity (identity element).

  • Method Details

    • of

      public static BLS12_381G2Point of(Fp2Element x, Fp2Element y)
      Constructs a G2 point from affine coordinates and verifies that (x, y) satisfies the curve equation y^2 = x^3 + 4*(1+I).

    • isInfinity

      public boolean isInfinity()

    • x

      public Fp2Element x()

    • y

      public Fp2Element y()

    • negate

      public BLS12_381G2Point negate()

    • add

      public BLS12_381G2Point add(BLS12_381G2Point other)

    • doublePoint

      public BLS12_381G2Point doublePoint()

    • constantTimeMultiply

      public BLS12_381G2Point constantTimeMultiply(BigInteger scalar)
      Constant-time scalar multiplication, suitable for secret scalars (e.g. sk * H(msg) in BLS sign).

      Uses a fixed-iteration "double, conditionally add" ladder over 256 bits, with the conditional-add implemented as an array-indexed select rather than an if. Both branches of every iteration compute the same set of point operations regardless of the scalar-bit value, so the per-bit timing does not depend on the scalar.

      Caveats. "Constant-time" here means the scalar-bit-pattern-independent at the scalar-mult loop level. The underlying affine point ops still have data-dependent branches for infinity / equal-x cases (which are negligibly probable for random secret scalars on a prime-order subgroup), and the JVM itself may introduce cache / GC / JIT timing variance that pure Java cannot fully eliminate. Sufficient against a remote network timing attacker on a typical workload; not a substitute for a constant-time native implementation against a co-located adversary with cache-line resolution.

    • multiply

      public BLS12_381G2Point multiply(BigInteger scalar)
      Variable-time double-and-add scalar multiplication. Suitable for non-secret scalars (e.g. cofactor clearing); not safe for secret scalar use — see constantTimeMultiply(BigInteger).

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object