bn256

Documentation

Overview

Package bn256 implements a particular bilinear group at the 128-bit security level.

Bilinear groups are the basis of many of the new cryptographic protocols that have been proposed over the past decade. They consist of a triplet of groups (G₁, G₂ and GT) such that there exists a function e(g₁ˣ,g₂ʸ)=gTˣʸ (where gₓ is a generator of the respective group). That function is called a pairing function.

This package specifically implements the Optimal Ate pairing over a 256-bit Barreto-Naehrig curve as described in http://cryptojedi.org/papers/dclxvi-20100714.pdf. Its output is compatible with the implementation described in that paper.

Index

• Variables
• func PairingCheck(a []*G1, b []*G2) bool
• type G1
  • func RandomG1(r io.Reader) (*big.Int, *G1, error)
  • func (e *G1) Add(a, b *G1) *G1
  • func (e *G1) CurvePoints() (*big.Int, *big.Int, *big.Int, *big.Int)
  • func (e *G1) IsZero() bool
  • func (n *G1) Marshal() []byte
  • func (e *G1) Neg(a *G1) *G1
  • func (e *G1) ScalarBaseMult(k *big.Int) *G1
  • func (e *G1) ScalarMult(a *G1, k *big.Int) *G1
  • func (e *G1) SetInfinity() *G1
  • func (e *G1) SetZero()
  • func (g *G1) String() string
  • func (e *G1) Unmarshal(m []byte) (*G1, bool)
• type G2
  • func RandomG2(r io.Reader) (*big.Int, *G2, error)
  • func (e *G2) Add(a, b *G2) *G2
  • func (e *G2) CurvePoints() (*gfP2, *gfP2, *gfP2, *gfP2)
  • func (e *G2) IsZero() bool
  • func (n *G2) Marshal() []byte
  • func (e *G2) Neg(a *G2) *G2
  • func (e *G2) ScalarBaseMult(k *big.Int) *G2
  • func (e *G2) ScalarMult(a *G2, k *big.Int) *G2
  • func (e *G2) SetInfinity() *G2
  • func (g *G2) String() string
  • func (e *G2) Unmarshal(m []byte) (*G2, bool)
• type GT
  • func Pair(g1 *G1, g2 *G2) *GT
  • func (e *GT) Add(a, b *GT) *GT
  • func (e *GT) Exp(a *GT, k *big.Int) *GT
  • func (e *GT) Invert(a *GT) *GT
  • func (e *GT) IsOne() bool
  • func (e *GT) IsZero() bool
  • func (n *GT) Marshal() []byte
  • func (e *GT) Neg(a *GT) *GT
  • func (e *GT) ScalarMult(a *GT, k *big.Int) *GT
  • func (g *GT) String() string
  • func (e *GT) Unmarshal(m []byte) (*GT, bool)
• Bugs

Variables

var Order = intconversion.BigFromBase10("21888242871839275222246405745257275088548364400416034343698204186575808495617")

Order is the number of elements in both G₁ and G₂: 36u⁴+36u³+18u²+6u+1.

var P = intconversion.BigFromBase10("21888242871839275222246405745257275088696311157297823662689037894645226208583")

p is a prime over which we form a basic field: 36u⁴+36u³+24u²+6u+1.

Functions

func PairingCheck

func PairingCheck(a []*G1, b []*G2) bool

PairingCheck calculates the Optimal Ate pairing for a set of points.

Types

type G1

type G1 struct {
	// contains filtered or unexported fields
}

Comments: - This implementation is not constant time, which means that it is vulnerable to side channel attacks. - If we keep GF(p²) elements in Montgomery form, it is possible to improve performance. - G1 is an abstract cyclic group. The zero value is suitable for use as the output of an operation, but cannot be used as an input.

func RandomG1

func RandomG1(r io.Reader) (*big.Int, *G1, error)

RandomG1 returns x and g₁ˣ where x is a random, non-zero number read from r.

func (*G1) Add

func (e *G1) Add(a, b *G1) *G1

Add sets e to a+b and then returns e. BUG(agl): this function is not complete: a==b fails.

func (*G1) CurvePoints

func (e *G1) CurvePoints() (*big.Int, *big.Int, *big.Int, *big.Int)

CurvePoints returns p's curve points in big integer

func (*G1) IsZero

func (e *G1) IsZero() bool

IsZero returns true iff a = 0.

func (*G1) Marshal

func (n *G1) Marshal() []byte

Marshal converts n to a byte slice.

func (*G1) Neg

func (e *G1) Neg(a *G1) *G1

Neg sets e to -a and then returns e.

func (*G1) ScalarBaseMult

func (e *G1) ScalarBaseMult(k *big.Int) *G1

ScalarBaseMult sets e to g*k where g is the generator of the group and then returns e. This method was updated to deal with negative numbers.

func (*G1) ScalarMult

func (e *G1) ScalarMult(a *G1, k *big.Int) *G1

ScalarMult sets e to a*k and then returns e. This method was updated to deal with negative numbers.

func (*G1) SetInfinity

func (e *G1) SetInfinity() *G1

Set to identity element on the group.

func (*G1) SetZero

func (e *G1) SetZero()

SetZero returns true iff a = 0.

func (*G1) String

func (g *G1) String() string

func (*G1) Unmarshal

func (e *G1) Unmarshal(m []byte) (*G1, bool)

Unmarshal sets e to the result of converting the output of Marshal back into a group element and then returns e.

type G2

type G2 struct {
	// contains filtered or unexported fields
}

G2 is an abstract cyclic group. The zero value is suitable for use as the output of an operation, but cannot be used as an input.

func RandomG2

func RandomG2(r io.Reader) (*big.Int, *G2, error)

RandomG1 returns x and g₂ˣ where x is a random, non-zero number read from r.

func (*G2) Add

func (e *G2) Add(a, b *G2) *G2

Add sets e to a+b and then returns e. BUG(agl): this function is not complete: a==b fails.

func (*G2) CurvePoints

func (e *G2) CurvePoints() (*gfP2, *gfP2, *gfP2, *gfP2)

CurvePoints returns the curve points of p which includes the real and imaginary parts of the curve point.

func (*G2) IsZero

func (e *G2) IsZero() bool

IsZero returns true iff a = 0.

func (*G2) Marshal

func (n *G2) Marshal() []byte

Marshal converts n into a byte slice.

func (*G2) Neg

func (e *G2) Neg(a *G2) *G2

Neg sets e to -a and then returns e.

func (*G2) ScalarBaseMult

func (e *G2) ScalarBaseMult(k *big.Int) *G2

ScalarBaseMult sets e to g*k where g is the generator of the group and then returns out. This method was updated to deal with negative numbers.

func (*G2) ScalarMult

func (e *G2) ScalarMult(a *G2, k *big.Int) *G2

ScalarMult sets e to a*k and then returns e. This method was updated to deal with negative numbers.

func (*G2) SetInfinity

func (e *G2) SetInfinity() *G2

Set to identity element on the group.

func (*G2) String

func (g *G2) String() string

func (*G2) Unmarshal

func (e *G2) Unmarshal(m []byte) (*G2, bool)

Unmarshal sets e to the result of converting the output of Marshal back into a group element and then returns e.

type GT

type GT struct {
	// contains filtered or unexported fields
}

GT is an abstract cyclic group. The zero value is suitable for use as the output of an operation, but cannot be used as an input.

func Pair

func Pair(g1 *G1, g2 *G2) *GT

Pair calculates an Optimal Ate pairing.

func (*GT) Add

func (e *GT) Add(a, b *GT) *GT

Add sets e to a+b and then returns e.

func (*GT) Exp

func (e *GT) Exp(a *GT, k *big.Int) *GT

func (*GT) Invert

func (e *GT) Invert(a *GT) *GT

func (*GT) IsOne

func (e *GT) IsOne() bool

IsOne returns true iff a = 0.

func (*GT) IsZero

func (e *GT) IsZero() bool

IsZero returns true iff a = 0.

func (*GT) Marshal

func (n *GT) Marshal() []byte

Marshal converts n into a byte slice.

func (*GT) Neg

func (e *GT) Neg(a *GT) *GT

Neg sets e to -a and then returns e.

func (*GT) ScalarMult

func (e *GT) ScalarMult(a *GT, k *big.Int) *GT

ScalarMult sets e to a*k and then returns e.

func (*GT) String

func (g *GT) String() string

func (*GT) Unmarshal

func (e *GT) Unmarshal(m []byte) (*GT, bool)

Unmarshal sets e to the result of converting the output of Marshal back into a group element and then returns e.

Notes

Bugs

• this function is not complete: a==b fails.

• this function is not complete: a==b fails.