Class BLS12_381SubgroupCheck

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381SubgroupCheck
public class BLS12_381SubgroupCheck extends Object
Fast subgroup-membership tests for BLS12-381 G1 and G2, replacing the naive [r] * P == 0 scalar multiplication (255-bit).

For G1: the GLV endomorphism σ(x, y) = (β·x, y), where β is a primitive cube root of unity in Fp, has eigenvalue λ = x² - 1 on G1 (a primitive cube root of unity in Z/r). The test σ(P) == [λ] P reduces the scalar to ~128 bits.

For G2: the untwist-Frobenius-twist endomorphism ψ has eigenvalue x (the BLS parameter) on G2. The test ψ(P) == [x] P reduces the scalar to ~64 bits, and ψ itself is essentially free (one Fp² conjugation + one Fp² multiplication per coordinate).

Both checks assume the input is already on the corresponding curve; verifying the curve equation is the caller's responsibility (and is done implicitly by BLS12_381G2Point.of(Fp2Element, Fp2Element) for G2 and ECPoint.isValid() for G1).

  • Method Details

    • sigmaG1

      public static ECPoint sigmaG1(ECPoint p)
      The GLV endomorphism on G1: σ(x, y) = (β·x, y).

      Exposed for cross-package layered testing (the test classes live in org.bouncycastle.crypto.hash2curve.test and need direct access to the endomorphism for verification against the naive [r] * P == 0 check). Not part of the intended public API of this class — production callers should use isInG1Subgroup(ECPoint).

    • psiG2

      public static BLS12_381G2Point psiG2(BLS12_381G2Point p)
      The untwist-Frobenius-twist endomorphism on G2: (x, y) -> (conjugate(x) * PSI_X, conjugate(y) * PSI_Y).

      Exposed for cross-package layered testing (see sigmaG1(ECPoint) for the rationale). Not part of the intended public API of this class — production callers should use isInG2Subgroup(BLS12_381G2Point).

    • isInG1Subgroup

      public static boolean isInG1Subgroup(ECPoint p)
      Test G1 prime-order subgroup membership.

      Returns true iff σ(P) == [x² - 1] P, which is equivalent to [r] P == 0 for any P on E(Fp).

    • isInG2Subgroup

      public static boolean isInG2Subgroup(BLS12_381G2Point p)
      Test G2 prime-order subgroup membership.

      Returns true iff ψ(P) == [x] P, which is equivalent to [r] P == 0 for any P on E'(Fp²).