Package org.bouncycastle.crypto.bls

package org.bouncycastle.crypto.bls
BLS signatures over the BLS12-381 curve, per draft-irtf-cfrg-bls-signature.

The three ciphersuite variants are provided as static-API classes — BLS12_381BasicScheme, BLS12_381MessageAugmentation and BLS12_381ProofOfPossession — with a BC-conventional signer / key-pair generator surface alongside in org.bouncycastle.crypto.signers (BLSSigner) and org.bouncycastle.crypto.generators (BLSKeyPairGenerator). Keys and signatures use the compressed Zcash point encoding (48-byte G1 public keys, 96-byte G2 signatures).

  • Classes
    Class
    Description
    BLS12_381Aggregation
    Helper for aggregating BLS12-381 signatures and verifying aggregates.
    BLS12_381BasicScheme
    BLS signatures BasicScheme over BLS12-381, per draft-irtf-cfrg-bls-signature (variant: public keys in G1, signatures in G2; suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_).
    BLS12_381G1
    Curve parameters for BLS12-381 G1, the prime-order subgroup of E(Fp) defined by y^2 = x^3 + 4 over Fp, as standardised in draft-irtf-cfrg-bls-signature and RFC 9380 sec. 8.8.1.
    BLS12_381G2
    Curve parameters for BLS12-381 G2, the prime-order subgroup of E(Fp^2) defined by y^2 = x^3 + 4 * (1 + I) over Fp^2.
    BLS12_381G2HashToCurve
    Implementation of the BLS12381G2_XMD:SHA-256_SSWU_RO_ hash-to-curve suite (RFC 9380 sec. 8.8.2): a deterministic, uniform map from a byte string and a domain-separation tag to a point in the BLS12-381 G2 prime-order subgroup.
    BLS12_381G2Point
    Affine point on the BLS12-381 G2 curve E: y^2 = x^3 + 4*(1+I) over Fp^2.
    BLS12_381MessageAugmentation
    BLS signatures MessageAugmentation suite over BLS12-381, per draft-irtf-cfrg-bls-signature: signature suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_AUG_.
    BLS12_381Pairing
    Optimal ate pairing on BLS12-381: a bilinear, non-degenerate map e: G1 x G2 -> GT where GT is the order-r subgroup of Fp^12 ^*.
    BLS12_381ProofOfPossession
    BLS signatures ProofOfPossession suite over BLS12-381, per draft-irtf-cfrg-bls-signature: signature suite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_ together with a separate proof-of-possession message that uses the BLS_POP_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_ DST.
    BLS12_381Serialization
    Zcash-format compressed point serialization for BLS12-381 G1 and G2, matching the encoding used by Zcash, Eth2, Filecoin, and the IETF pairing-friendly-curves draft.
    BLS12_381SubgroupCheck
    Fast subgroup-membership tests for BLS12-381 G1 and G2, replacing the naive [r] * P == 0 scalar multiplication (255-bit).
    Fp12Element
    Immutable element of Fp^12 = Fp^6[w] / (w^2 - v), the outer level of the BLS12-381 pairing field tower.
    Fp2Element
    Immutable element of Fp^2 = Fp[I] / (I^2 + 1), used as the base field of BLS12-381 G2.
    Fp6Element
    Immutable element of Fp^6 = Fp^2[v] / (v^3 - (1 + I)), the cubic extension of Fp2Element used as the inner level of the BLS12-381 pairing field tower.