README
¶
BN256
This is a slightly extended version of https://github.com/cloudflare/bn256. Added functionality:
- hashing to G1 and G2 groups and some functionality needed for hashing (like computation of square root in GFp2)
- mapping from string to GT group and back
Documentation
¶
Overview ¶
Package bn256 implements a particular bilinear group.
Bilinear groups are the basis of many of the new cryptographic protocols that have been proposed over the past decade. They consist of a triplet of groups (G₁, G₂ and GT) such that there exists a function e(g₁ˣ,g₂ʸ)=gTˣʸ (where gₓ is a generator of the respective group). That function is called a pairing function.
This package specifically implements the Optimal Ate pairing over a 256-bit Barreto-Naehrig curve as described in http://cryptojedi.org/papers/dclxvi-20100714.pdf. Its output is compatible with the implementation described in that paper.
This package previously claimed to operate at a 128-bit security level. However, recent improvements in attacks mean that is no longer true. See https://moderncrypto.org/mail-archive/curves/2016/000740.html.
Index ¶
- Variables
- func MapGTToString(gt *GT) string
- type G1
- type G2
- type GT
- func (e *GT) Add(a, b *GT) *GT
- func (e *GT) Finalize() *GT
- func (e *GT) Marshal() []byte
- func (e *GT) Neg(a *GT) *GT
- func (e *GT) ScalarBaseMult(k *big.Int) *GT
- func (e *GT) ScalarMult(a *GT, k *big.Int) *GT
- func (e *GT) Set(a *GT) *GT
- func (g *GT) String() string
- func (e *GT) Unmarshal(m []byte) ([]byte, error)
Examples ¶
Constants ¶
This section is empty.
Variables ¶
var Order = bigFromBase10("65000549695646603732796438742359905742570406053903786389881062969044166799969")
Order is the number of elements in both G₁ and G₂: 36u⁴+36u³+18u²+6u+1. order-1 = (2**5) * 3 * 5743 * 280941149 * 130979359433191 * 491513138693455212421542731357 * 6518589491078791937
Functions ¶
func MapGTToString ¶
MapGTToString maps an element from GT group to a string.
Types ¶
type G1 ¶
type G1 struct {
P *curvePoint
}
G1 is an abstract cyclic group. The zero value is suitable for use as the output of an operation, but cannot be used as an input.
func (*G1) ScalarBaseMult ¶
ScalarBaseMult sets e to g*k where g is the generator of the group and then returns e.
func (*G1) ScalarMult ¶
ScalarMult sets e to a*k and then returns e.
type G2 ¶
type G2 struct {
P *twistPoint
}
G2 is an abstract cyclic group. The zero value is suitable for use as the output of an operation, but cannot be used as an input.
func HashG2 ¶
HashG2 hashes string m to an element in group G2. It uses: Fuentes-Castaneda, Laura, Edward Knapp, and Francisco Rodríguez-Henríquez. "Faster hashing to G_2." International Workshop on Selected Areas in Cryptography. Springer, Berlin, Heidelberg, 2011.
func (*G2) ScalarBaseMult ¶
ScalarBaseMult sets e to g*k where g is the generator of the group and then returns out.
func (*G2) ScalarMult ¶
ScalarMult sets e to a*k and then returns e.
type GT ¶
type GT struct {
P *gfP12
}
GT is an abstract cyclic group. The zero value is suitable for use as the output of an operation, but cannot be used as an input.
func MapStringToGT ¶
MapStringToGT maps a string to GT group element. Needed for example when a message to be encrypted needs to be mapped into GT group.
func Miller ¶
Miller applies Miller's algorithm, which is a bilinear function from the source groups to F_p^12. Miller(g1, g2).Finalize() is equivalent to Pair(g1, g2).
func Pair ¶
Pair calculates an Optimal Ate pairing.
Example ¶
// This implements the tripartite Diffie-Hellman algorithm from "A One // Round Protocol for Tripartite Diffie-Hellman", A. Joux. // http://www.springerlink.com/content/cddc57yyva0hburb/fulltext.pdf // Each of three parties, a, b and c, generate a private value. a, _ := rand.Int(rand.Reader, Order) b, _ := rand.Int(rand.Reader, Order) c, _ := rand.Int(rand.Reader, Order) // Then each party calculates g₁ and g₂ times their private value. pa := new(G1).ScalarBaseMult(a) qa := new(G2).ScalarBaseMult(a) pb := new(G1).ScalarBaseMult(b) qb := new(G2).ScalarBaseMult(b) pc := new(G1).ScalarBaseMult(c) qc := new(G2).ScalarBaseMult(c) // Now each party exchanges its public values with the other two and // all parties can calculate the shared key. k1 := Pair(pb, qc) k1.ScalarMult(k1, a) k2 := Pair(pc, qa) k2.ScalarMult(k2, b) k3 := Pair(pa, qb) k3.ScalarMult(k3, c) // k1, k2 and k3 will all be equal.
Output:
func (*GT) ScalarBaseMult ¶
ScalarBaseMult sets e to g*k where g is the generator of the group and then returns out.
func (*GT) ScalarMult ¶
ScalarMult sets e to a*k and then returns e.
Source Files