Class BLS12_381Serialization

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381Serialization
public class BLS12_381Serialization extends Object
Zcash-format compressed point serialization for BLS12-381 G1 and G2, matching the encoding used by Zcash, Eth2, Filecoin, and the IETF pairing-friendly-curves draft.

G1 compressed encoding is 48 bytes; G2 compressed encoding is 96 bytes. The high three bits of the first byte are flags:

  • bit 7 (0x80): compressed (always set in this format)
  • bit 6 (0x40): infinity (set iff this is the point at infinity)
  • bit 5 (0x20): y-sign (set iff y > -y in the encoded byte order)
Because BLS12-381 Fp is 381 bits, the x-coordinate big-endian bytes have three free top bits, which is where the flag bits live. For Fp² coordinates, Zcash convention orders (c1, c0) — the imaginary part first.

The y-sign flag uses the lexicographic ordering of the encoded y versus -y: for Fp this reduces to y > (p-1)/2, for Fp² to "y.c1 > (p-1)/2, or y.c0 > (p-1)/2 when y.c1 == 0".

Decompression validates the curve equation and the flag combinations but does not perform a prime-order subgroup check — callers that need a validated public key or a subgroup-checked signature should do that explicitly.

  • Method Details

    • compressG1

      public static byte[] compressG1(ECPoint point)
      Compress a G1 point to its 48-byte Zcash-format encoding.

    • decompressG1

      public static ECPoint decompressG1(byte[] bytes, ECCurve curve)
      Decompress a 48-byte Zcash-format encoding back to a G1 point on the supplied curve. Validates the flag combinations and the curve equation; does not subgroup-check.

    • compressG2

      public static byte[] compressG2(BLS12_381G2Point point)
      Compress a G2 point to its 96-byte Zcash-format encoding.

    • decompressG2

      public static BLS12_381G2Point decompressG2(byte[] bytes)
      Decompress a 96-byte Zcash-format encoding back to a G2 point. Validates the flag combinations, that the recovered x is in Fp², and that (x, y) satisfies the G2 curve equation; does not subgroup-check.