bls12381

package
v0.3.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 9, 2026 License: Apache-2.0 Imports: 16 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var G1Jacs g1JacPool

G1Jacs is a shared *bls12381.G1Jac{} memory pool

Functions

func JointScalarMultiplication 

func JointScalarMultiplication(p *bls12381.G1Jac, a1, a2 *bls12381.G1Affine, s1, s2 *big.Int) *bls12381.G1Jac

JointScalarMultiplication computes [s1]a1+[s2]a2 using Strauss-Shamir technique where a1 and a2 are affine points. This does not use the GLV endomorphism (unlike G1Jac.ScalarMultiplication), so it is an allocation optimization over two independent scalar multiplications plus an addition, not a wall-clock optimization.

Types

type BBSCurve 

type BBSCurve struct {
	Curve
}

func NewBBSCurve 

func NewBBSCurve() *BBSCurve

func (*BBSCurve) HashToG1 

func (c *BBSCurve) HashToG1(data []byte) driver.G1

func (*BBSCurve) HashToG1WithDomain 

func (c *BBSCurve) HashToG1WithDomain(data, domain []byte) driver.G1

func (*BBSCurve) HashToG2 

func (c *BBSCurve) HashToG2(data []byte) driver.G2

func (*BBSCurve) HashToG2WithDomain 

func (c *BBSCurve) HashToG2WithDomain(data, domain []byte) driver.G2

type Curve 

type Curve struct {
	common.CurveBase
}

func NewCurve 

func NewCurve() *Curve

func (*Curve) CompressedG1ByteSize 

func (c *Curve) CompressedG1ByteSize() int

func (*Curve) CompressedG2ByteSize 

func (c *Curve) CompressedG2ByteSize() int

func (*Curve) CoordinateByteSize 

func (c *Curve) CoordinateByteSize() int

func (*Curve) FExp 

func (c *Curve) FExp(a driver.Gt) driver.Gt

func (*Curve) G1ByteSize 

func (c *Curve) G1ByteSize() int

func (*Curve) G2ByteSize 

func (c *Curve) G2ByteSize() int

func (*Curve) GenG1 

func (c *Curve) GenG1() driver.G1

func (*Curve) GenG2 

func (c *Curve) GenG2() driver.G2

func (*Curve) GenGt 

func (c *Curve) GenGt() driver.Gt

func (*Curve) GroupOrder 

func (c *Curve) GroupOrder() driver.Zr

func (*Curve) HashToG1 

func (c *Curve) HashToG1(data []byte) driver.G1

func (*Curve) HashToG1WithDomain 

func (c *Curve) HashToG1WithDomain(data, domain []byte) driver.G1

func (*Curve) HashToG2 

func (c *Curve) HashToG2(data []byte) driver.G2

func (*Curve) HashToG2WithDomain 

func (c *Curve) HashToG2WithDomain(data, domain []byte) driver.G2

func (*Curve) HashToZr 

func (c *Curve) HashToZr(data []byte) driver.Zr

func (*Curve) ModAdd 

func (c *Curve) ModAdd(a1, b1, m driver.Zr) driver.Zr

func (*Curve) ModAdd2 

func (c *Curve) ModAdd2(a1, b1, c1, m driver.Zr)

func (*Curve) ModAddMul 

func (c *Curve) ModAddMul(a1, b1 []driver.Zr, m driver.Zr) driver.Zr

func (*Curve) ModAddMul2 

func (c *Curve) ModAddMul2(a1 driver.Zr, c1 driver.Zr, b1 driver.Zr, c2 driver.Zr, m driver.Zr) driver.Zr

func (*Curve) ModAddMul2InPlace 

func (c *Curve) ModAddMul2InPlace(result driver.Zr, a1, c1, b1, c2, m driver.Zr)

func (*Curve) ModAddMul3 

func (c *Curve) ModAddMul3(
	a1 driver.Zr,
	a2 driver.Zr,
	b1 driver.Zr,
	b2 driver.Zr,
	d1 driver.Zr,
	d2 driver.Zr,
	m driver.Zr,
) driver.Zr

func (*Curve) ModAddMul3InPlace 

func (c *Curve) ModAddMul3InPlace(result driver.Zr, a1, a2, b1, b2, d1, d2, m driver.Zr)

func (*Curve) ModMul 

func (c *Curve) ModMul(a1, b1, m driver.Zr) driver.Zr

func (*Curve) ModMulInPlace 

func (c *Curve) ModMulInPlace(result, a, b, m driver.Zr)

func (*Curve) ModNeg 

func (c *Curve) ModNeg(a1, m driver.Zr) driver.Zr

func (*Curve) ModSub 

func (c *Curve) ModSub(a1, b1, m driver.Zr) driver.Zr

func (*Curve) MultiScalarMul 

func (c *Curve) MultiScalarMul(a []driver.G1, b []driver.Zr) driver.G1

MultiScalarMul computes the sum of the scalar multiplications of the given bases by the given scalars via gnark's bucket-method MultiExp. MultiExp carries a fixed cost (window and chunk setup, goroutine fan-out) that a pairwise Mul2+Add loop does not, so for very small n a caller that knows its sizes may be better served by Mul/Mul2 directly; callers that care make that choice themselves, and this method does not second-guess them beyond the trivial n==0 and n==1 cases.

func (*Curve) NewG1 

func (c *Curve) NewG1() driver.G1

func (*Curve) NewG1FromBytes 

func (c *Curve) NewG1FromBytes(b []byte) driver.G1

func (*Curve) NewG1FromCompressed 

func (c *Curve) NewG1FromCompressed(b []byte) driver.G1

func (*Curve) NewG2 

func (c *Curve) NewG2() driver.G2

func (*Curve) NewG2FromBytes 

func (c *Curve) NewG2FromBytes(b []byte) driver.G2

func (*Curve) NewG2FromCompressed 

func (c *Curve) NewG2FromCompressed(b []byte) driver.G2

func (*Curve) NewGtFromBytes 

func (c *Curve) NewGtFromBytes(b []byte) driver.Gt

func (*Curve) NewRandomZr 

func (c *Curve) NewRandomZr(rng io.Reader) driver.Zr

NewRandomZr draws a uniformly random scalar using rng as the exclusive source of entropy (so the same reader/seed always produces the same scalar), via rejection sampling on a stack buffer - the same strategy fr.Element.SetRandom uses internally, but reading from the caller's reader instead of crypto/rand. Acceptance probability is q/2^255 ~= 0.90, i.e. ~1.1 iterations expected. Allocation-free, unlike a rand.Int-based implementation.

func (*Curve) NewZrFromBigInt 

func (c *Curve) NewZrFromBigInt(i *big.Int) driver.Zr

func (*Curve) NewZrFromBytes 

func (c *Curve) NewZrFromBytes(b []byte) driver.Zr

func (*Curve) NewZrFromInt64 

func (c *Curve) NewZrFromInt64(i int64) driver.Zr

func (*Curve) NewZrFromUint64 

func (c *Curve) NewZrFromUint64(i uint64) driver.Zr

func (*Curve) Pairing 

func (c *Curve) Pairing(p2 driver.G2, p1 driver.G1) driver.Gt

func (*Curve) Pairing2 

func (c *Curve) Pairing2(p2a, p2b driver.G2, p1a, p1b driver.G1) driver.Gt

func (*Curve) Rand 

func (p *Curve) Rand() (io.Reader, error)

func (*Curve) ScalarByteSize 

func (c *Curve) ScalarByteSize() int

type G1 

type G1 struct {
	bls12381.G1Affine
}

func (*G1) Add 

func (g *G1) Add(a driver.G1)

func (*G1) Bytes 

func (g *G1) Bytes() []byte

func (*G1) Clone 

func (g *G1) Clone(a driver.G1)

func (*G1) Compressed 

func (g *G1) Compressed() []byte

func (*G1) Copy 

func (e *G1) Copy() driver.G1

func (*G1) Equals 

func (g *G1) Equals(a driver.G1) bool

func (*G1) IsInfinity 

func (g *G1) IsInfinity() bool

func (*G1) Mul 

func (g *G1) Mul(a driver.Zr) driver.G1

func (*G1) Mul2 

func (g *G1) Mul2(e driver.Zr, Q driver.G1, f driver.Zr) driver.G1

Mul2 computes [e]g + [f]Q via a joint Strauss-Shamir scalar multiplication. Benchmarked against two independent Mul calls plus an Add: allocates far less (1 vs ~26 allocs) but is not faster in wall-clock time, because — unlike Mul — it does not use the GLV endomorphism speedup, so it forgoes the ~2x speedup that GLV gives each individual scalar multiplication.

func (*G1) Mul2InPlace 

func (g *G1) Mul2InPlace(e driver.Zr, Q driver.G1, f driver.Zr)

func (*G1) Neg 

func (g *G1) Neg()

func (*G1) String 

func (g *G1) String() string

func (*G1) Sub 

func (g *G1) Sub(a driver.G1)

type G2 

type G2 struct {
	bls12381.G2Affine
}

func (*G2) Add 

func (g *G2) Add(a driver.G2)

func (*G2) Affine 

func (g *G2) Affine()

func (*G2) Bytes 

func (g *G2) Bytes() []byte

func (*G2) Clone 

func (g *G2) Clone(a driver.G2)

func (*G2) Compressed 

func (g *G2) Compressed() []byte

func (*G2) Copy 

func (e *G2) Copy() driver.G2

func (*G2) Equals 

func (g *G2) Equals(a driver.G2) bool

func (*G2) Mul 

func (g *G2) Mul(a driver.Zr) driver.G2

func (*G2) String 

func (g *G2) String() string

func (*G2) Sub 

func (g *G2) Sub(a driver.G2)

type Gt 

type Gt struct {
	bls12381.GT
}

func (*Gt) Bytes 

func (g *Gt) Bytes() []byte

func (*Gt) Equals 

func (g *Gt) Equals(a driver.Gt) bool

func (*Gt) Exp 

func (g *Gt) Exp(x driver.Zr) driver.Gt

func (*Gt) Inverse 

func (g *Gt) Inverse()

func (*Gt) IsUnity 

func (g *Gt) IsUnity() bool

func (*Gt) Mul 

func (g *Gt) Mul(a driver.Gt)

func (*Gt) ToString 

func (g *Gt) ToString() string

type Zr 

type Zr struct {
	// contains filtered or unexported fields
}

Zr represents a scalar field element backed by fr.Element ([4]uint64). The rawBigInt field is non-nil only for special values like GroupOrder (which equals p and is 0 in the field but needs its actual big.Int value for operations like Mod and InvModP).

Only methods that explicitly branch on rawBigInt (IsZero, IsOne, Bytes, Equals, Copy, Clone, String, Mod, InvModP, InvModOrder, PowMod, toBigInt) preserve the true big-int value. Plus/Minus/Mul operate on val directly (val == 0 whenever rawBigInt != nil, since p mod p == 0), so arithmetic combining a rawBigInt-backed Zr with another Zr via Plus/Minus/Mul silently ignores the raw value. This is safe today because GroupOrder is only ever used as a PowMod exponent (where the result is invariant to the field reduction by Fermat's little theorem) or passed to the rawBigInt-aware methods above — do not add a new arithmetic use of GroupOrder via Plus/Minus/Mul without accounting for this.

func (*Zr) BigInt 

func (b *Zr) BigInt() *big.Int

func (*Zr) Bytes 

func (b *Zr) Bytes() []byte

func (*Zr) Clone 

func (b *Zr) Clone(a driver.Zr)

func (*Zr) Copy 

func (b *Zr) Copy() driver.Zr

func (*Zr) Equals 

func (b *Zr) Equals(p driver.Zr) bool

func (*Zr) InvModOrder 

func (b *Zr) InvModOrder()

func (*Zr) InvModP 

func (b *Zr) InvModP(p driver.Zr)

func (*Zr) IsOne 

func (b *Zr) IsOne() bool

func (*Zr) IsZero 

func (b *Zr) IsZero() bool

func (*Zr) Minus 

func (b *Zr) Minus(a driver.Zr) driver.Zr

func (*Zr) Mod 

func (b *Zr) Mod(a driver.Zr)

func (*Zr) Mul 

func (b *Zr) Mul(x driver.Zr) driver.Zr

func (*Zr) Neg 

func (b *Zr) Neg()

func (*Zr) Plus 

func (b *Zr) Plus(a driver.Zr) driver.Zr

func (*Zr) PowMod 

func (b *Zr) PowMod(x driver.Zr) driver.Zr

func (*Zr) String 

func (b *Zr) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.