Module bls12_381 

BLS12-381 pairing-friendly elliptic curve implementation.

This module exposes low-level group, scalar, RFC 9380 hash-to-curve, and pairing primitives. It does not implement a complete BLS signature ciphersuite (including key generation, proof of possession, aggregation, or protocol-specific input validation).

The following demonstrates the core equation used by an Eth2-style minimum-public-key-size construction. Production code must derive a nonzero secret scalar with the selected ciphersuite’s key-generation procedure, keep its encoded form in zeroizing storage, and enforce that ciphersuite’s validation rules. Bls12_381Scalar is a generic Copy field element for public arithmetic, not a protected secret-key container. The low-level msm_vartime helpers likewise accept public scalars only. Secret scalar multiplication must use multiply_secret_be_bytes, or callers should use the high-level BLS types in dcrypt-sign. External public keys should be decoded with G1Projective::from_bytes_validated, which rejects the identity. Complete BLS ciphersuites have more nuanced signature identity rules, so callers should use the high-level types in dcrypt-sign rather than assembling a signature protocol from these primitives.

use dcrypt_algorithms::ec::bls12_381::{
    pairing, G1Affine, G1Projective, G2Affine, G2Projective,
};
use dcrypt_api::types::SecretBytes;

// Demonstration only: KeyGen normally derives 48 pseudorandom OKM bytes
// using HKDF and reduces it modulo r. SecretBytes owns and clears the
// resulting canonical big-endian scalar.
let mut encoded_secret = [0u8; 32];
encoded_secret[31] = 42;
let secret_bytes = SecretBytes::new(encoded_secret);

let public_key = G1Affine::from(
    G1Projective::generator().multiply_secret_be_bytes(&secret_bytes)?,
);
let message_point = G2Projective::hash_to_curve(
    b"message",
    b"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_",
)?;
let signature = G2Affine::from(message_point.multiply_secret_be_bytes(&secret_bytes)?);
let message_point = G2Affine::from(message_point);

assert_eq!(
    pairing(&public_key, &message_point),
    pairing(&G1Affine::generator(), &signature),
);
drop(secret_bytes);

Structs

Bls12

BLS12-381 pairing engine marker.

Bls12_381Scalar

Scalar field element of BLS12-381 for public arithmetic.

G1Affine

G₁ affine point representation.

G1Projective

G₁ projective point representation.

G2Affine

G₂ affine point representation.

G2Prepared

Pre-computed G2 for efficient multi-pairing.

G2Projective

G₂ projective point representation.

Gt

Target group G_T element.

MillerLoopResult

Miller loop result - must be finalized via .final_exponentiation() for comparison.

Functions

hash_to_curve_g1

Hash a message to G1 using BLS12381G1_XMD:SHA-256_SSWU_RO_.

hash_to_curve_g2

Hash a message to G2 using BLS12381G2_XMD:SHA-256_SSWU_RO_.

multi_miller_loop

Multi-pairing computation in single Miller loop.

pairing

Computes the BLS12-381 pairing.