Skip to content

Commit fe4f101

Browse files
armfazharmfazh
committed
Refactor the init function.
1 parent b364b81 commit fe4f101

File tree

7 files changed

+299
-266
lines changed

7 files changed

+299
-266
lines changed

‎ecc/bls12381/constants.go

+144-86
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package bls12381
22

33
import (
44
"errors"
5-
"fmt"
65

76
"github.com/cloudflare/circl/ecc/bls12381/ff"
87
)
@@ -17,43 +16,71 @@ const ScalarSize = ff.ScalarSize
1716
func Order() []byte { return ff.ScalarOrder() }
1817

1918
var (
20-
g1Params struct {
21-
b, _3b, genX, genY ff.Fp
22-
cofactorSmall [8]byte // (1-z), where z is the BLS12 parameter (big-endian).
23-
}
24-
g2Params struct {
25-
b, _3b, genX, genY ff.Fp2
26-
z [8]byte // z, where z is the BLS12 parameter (big-endian).
19+
bls12381 struct { // Let z be the BLS12 parameter.
20+
minusZ [8]byte // (-z), (integer big-endian).
21+
oneMinusZ [8]byte // (1-z), (integer big-endian).
22+
g1Check [16]byte // (z^2-1)/3, (integer big-endian).
2723
}
24+
g1Params struct{ b, _3b, genX, genY ff.Fp }
25+
g2Params struct{ b, _3b, genX, genY ff.Fp2 }
26+
27+
// g1Isog11 is an isogeny of degree 11 from g1Iso(a,b) to G1 and is given
28+
// by rational maps:
29+
// g1Iso(a,b) --> G1
30+
// (x,y,z) |-> (x,y,1)
31+
// (xNum/xDen, y * yNum/yDen, 1)
32+
// (xNum*yDen, y * yNum*xDen, z*xDen*yDen)
33+
// such that
34+
// xNum = \sum ai * x^i * z^(n-1-i), for 0 <= i < n, and n=12.
35+
// xDen = \sum bi * x^i * z^(n-1-i), for 0 <= i < n, and n=11.
36+
// yNum = \sum ci * x^i * z^(n-1-i), for 0 <= i < n, and n=16.
37+
// yDen = \sum di * x^i * z^(n-1-i), for 0 <= i < n, and n=16.
2838
g1Isog11 struct {
29-
a, b, c2 ff.Fp
30-
c1 [48]byte // integer c1 = (p - 3) / 4 (big-endian)
31-
xNum [12]ff.Fp
32-
xDen [11]ff.Fp
33-
yNum [16]ff.Fp
34-
yDen [16]ff.Fp
39+
a, b ff.Fp
40+
xNum [12]ff.Fp
41+
xDen [11]ff.Fp
42+
yNum [16]ff.Fp
43+
yDen [16]ff.Fp
3544
}
45+
46+
// g2Isog3 is an isogeny of degree 3 from g2Iso(a,b) to G2 and is given
47+
// by rational maps:
48+
// g2Iso(a,b) --> G2
49+
// (x,y,z) |-> (x,y,1)
50+
// (xNum/xDen, y * yNum/yDen, 1)
51+
// (xNum*yDen, y * yNum*xDen, z*xDen*yDen)
52+
// such that
53+
// xNum = \sum ai * x^i * z^(n-1-i), for 0 <= i < n, and n=4.
54+
// xDen = \sum bi * x^i * z^(n-1-i), for 0 <= i < n, and n=3.
55+
// yNum = \sum ci * x^i * z^(n-1-i), for 0 <= i < n, and n=4.
56+
// yDen = \sum di * x^i * z^(n-1-i), for 0 <= i < n, and n=4.
3657
g2Isog3 struct {
3758
a, b ff.Fp2
38-
c1 [95]byte // integer c1 = (p^2 - 9) / 16 (big-endian)
39-
c2 ff.Fp2 // sqrt(-1)
40-
c3 ff.Fp2 // sqrt(c2)
41-
c4 ff.Fp2 // sqrt(Z^3 / c3)
42-
c5 ff.Fp2 // sqrt(Z^3 / (c2 * c3))
4359
xNum [4]ff.Fp2
4460
xDen [3]ff.Fp2
4561
yNum [4]ff.Fp2
4662
yDen [4]ff.Fp2
4763
}
48-
g1Check struct {
49-
coef [16]byte // coef = (z^2-1)/3, where z is the BLS12 parameter (big-endian).
50-
beta0 ff.Fp // beta0 = F(2)^(2*(p-1)/3) where F = GF(p).
51-
beta1 ff.Fp // beta1 = F(2)^(1*(p-1)/3) where F = GF(p).
64+
g1sswu struct {
65+
Z ff.Fp // Z = 11.
66+
c1 [48]byte // integer c1 = (p - 3) / 4 (big-endian)
67+
c2 ff.Fp
68+
}
69+
g2sswu struct {
70+
Z ff.Fp2 // -(2 + I)
71+
c1 [95]byte // integer c1 = (p^2 - 9) / 16 (big-endian)
72+
c2 ff.Fp2 // sqrt(-1)
73+
c3 ff.Fp2 // sqrt(c2)
74+
c4 ff.Fp2 // sqrt(Z^3 / c3)
75+
c5 ff.Fp2 // sqrt(Z^3 / (c2 * c3))
76+
}
77+
g1Sigma struct {
78+
beta0 ff.Fp // beta0 = F(2)^(2*(p-1)/3) where F = GF(p).
79+
beta1 ff.Fp // beta1 = F(2)^(1*(p-1)/3) where F = GF(p).
5280
}
53-
g2PsiCoeff struct {
54-
minusZ [8]byte // (-z), where z is the BLS12 parameter (big-endian).
55-
alpha ff.Fp2 // alpha = w^2/Frob(w^2)
56-
beta ff.Fp2 // beta = w^3/Frob(w^3)
81+
g2Psi struct {
82+
alpha ff.Fp2 // alpha = w^2/Frob(w^2)
83+
beta ff.Fp2 // beta = w^3/Frob(w^3)
5784
}
5885
)
5986

@@ -66,31 +93,41 @@ func headerEncoding(isCompressed, isInfinity, isBigYCoord byte) byte {
6693
return (isBigYCoord&0x1)<<5 | (isInfinity&0x1)<<6 | (isCompressed&0x1)<<7
6794
}
6895

69-
// ratioKummer sets z = t/Frob(t) if it falls in Fp2, panics otherwise.
70-
func ratioKummer(z *ff.Fp2, t *ff.Fp12) {
71-
var r ff.Fp12
72-
r.Frob(t)
73-
r.Inv(&r)
74-
r.Mul(t, &r)
75-
if r[1].IsZero() != 1 || r[0][1].IsZero() != 1 || r[0][2].IsZero() != 1 {
76-
panic(fmt.Errorf("failure of result %v to be in Fp2", r))
96+
func err(e error) {
97+
if e != nil {
98+
panic(e)
7799
}
78-
*z = r[0][0]
79100
}
80101

81102
func init() {
82-
err := func(e error) {
83-
if e != nil {
84-
panic(e)
85-
}
103+
bls12381.oneMinusZ = [8]byte{ // (big-endian)
104+
0xd2, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01,
105+
}
106+
bls12381.minusZ = [8]byte{ // (big-endian)
107+
0xd2, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00,
108+
}
109+
bls12381.g1Check = [16]byte{ // (big-endian)
110+
0x39, 0x6c, 0x8c, 0x00, 0x55, 0x55, 0xe1, 0x56,
111+
0x00, 0x00, 0x00, 0x00, 0x55, 0x55, 0x55, 0x55,
86112
}
113+
initG1Params()
114+
initG2Params()
115+
initG1Isog11()
116+
initG2Isog3()
117+
initG1sswu()
118+
initG2sswu()
119+
initSigma()
120+
initPsi()
121+
}
87122

123+
func initG1Params() {
88124
g1Params.b.SetUint64(4)
89125
g1Params._3b.SetUint64(12)
90126
err(g1Params.genX.SetString("0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb"))
91127
err(g1Params.genY.SetString("0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1"))
92-
g1Params.cofactorSmall = [8]byte{0xd2, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01} // (big-endian)
128+
}
93129

130+
func initG2Params() {
94131
g2Params.b[0].SetUint64(4)
95132
g2Params.b[1].SetUint64(4)
96133
g2Params._3b[0].SetUint64(12)
@@ -99,20 +136,11 @@ func init() {
99136
err(g2Params.genX[1].SetString("0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e"))
100137
err(g2Params.genY[0].SetString("0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801"))
101138
err(g2Params.genY[1].SetString("0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be"))
102-
g2Params.z = [8]byte{0xd2, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01} // (big-endian)
139+
}
103140

104-
g1Isog11.c1 = [48]byte{ // (big-endian)
105-
0x06, 0x80, 0x44, 0x7a, 0x8e, 0x5f, 0xf9, 0xa6,
106-
0x92, 0xc6, 0xe9, 0xed, 0x90, 0xd2, 0xeb, 0x35,
107-
0xd9, 0x1d, 0xd2, 0xe1, 0x3c, 0xe1, 0x44, 0xaf,
108-
0xd9, 0xcc, 0x34, 0xa8, 0x3d, 0xac, 0x3d, 0x89,
109-
0x07, 0xaa, 0xff, 0xff, 0xac, 0x54, 0xff, 0xff,
110-
0xee, 0x7f, 0xbf, 0xff, 0xff, 0xff, 0xea, 0xaa,
111-
}
141+
func initG1Isog11() {
112142
err(g1Isog11.a.SetString("0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d"))
113143
err(g1Isog11.b.SetString("0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0"))
114-
err(g1Isog11.c2.SetString("0x3d689d1e0e762cef9f2bec6130316806b4c80eda6fc10ce77ae83eab1ea8b8b8a407c9c6db195e06f2dbeabc2baeff5"))
115-
116144
err(g1Isog11.xNum[0].SetString("0x11a05f2b1e833340b809101dd99815856b303e88a2d7005ff2627b56cdb4e2c85610c2d5f2e62d6eaeac1662734649b7"))
117145
err(g1Isog11.xNum[1].SetString("0x17294ed3e943ab2f0588bab22147a81c7c17e75b2f6a8417f565e33c70d1e86b4838f2a6f318c356e834eef1b3cb83bb"))
118146
err(g1Isog11.xNum[2].SetString("0x0d54005db97678ec1d1048c5d10a9a1bce032473295983e56878e501ec68e25c958c3e3d2a09729fe0179f9dac9edcb0"))
@@ -171,36 +199,11 @@ func init() {
171199
err(g1Isog11.yDen[13].SetString("0x02660400eb2e4f3b628bdd0d53cd76f2bf565b94e72927c1cb748df27942480e420517bd8714cc80d1fadc1326ed06f7"))
172200
err(g1Isog11.yDen[14].SetString("0x0e0fa1d816ddc03e6b24255e0d7819c171c40f65e273b853324efcd6356caa205ca2f570f13497804415473a1d634b8f"))
173201
g1Isog11.yDen[15].SetOne()
202+
}
174203

204+
func initG2Isog3() {
175205
err(g2Isog3.a.SetString("0x00", "0xF0"))
176206
err(g2Isog3.b.SetString("0x03F4", "0x03F4"))
177-
g2Isog3.c1 = [95]byte{ // (big-endian)
178-
0x2a, 0x43, 0x7a, 0x4b, 0x8c, 0x35, 0xfc, 0x74,
179-
0xbd, 0x27, 0x8e, 0xaa, 0x22, 0xf2, 0x5e, 0x9e,
180-
0x2d, 0xc9, 0x0e, 0x50, 0xe7, 0x04, 0x6b, 0x46,
181-
0x6e, 0x59, 0xe4, 0x93, 0x49, 0xe8, 0xbd, 0x05,
182-
0x0a, 0x62, 0xcf, 0xd1, 0x6d, 0xdc, 0xa6, 0xef,
183-
0x53, 0x14, 0x93, 0x30, 0x97, 0x8e, 0xf0, 0x11,
184-
0xd6, 0x86, 0x19, 0xc8, 0x61, 0x85, 0xc7, 0xb2,
185-
0x92, 0xe8, 0x5a, 0x87, 0x09, 0x1a, 0x04, 0x96,
186-
0x6b, 0xf9, 0x1e, 0xd3, 0xe7, 0x1b, 0x74, 0x31,
187-
0x62, 0xc3, 0x38, 0x36, 0x21, 0x13, 0xcf, 0xd7,
188-
0xce, 0xd6, 0xb1, 0xd7, 0x63, 0x82, 0xea, 0xb2,
189-
0x6a, 0xa0, 0x00, 0x01, 0xc7, 0x18, 0xe3,
190-
}
191-
err(g2Isog3.c2.SetString("0x00", "0x01"))
192-
err(g2Isog3.c3.SetString(
193-
"0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2",
194-
"0x6af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
195-
))
196-
err(g2Isog3.c4.SetString(
197-
"0x699be3b8c6870965e5bf892ad5d2cc7b0e85a117402dfd83b7f4a947e02d978498255a2aaec0ac627b5afbdf1bf1c90",
198-
"0x8157cd83046453f5dd0972b6e3949e4288020b5b8a9cc99ca07e27089a2ce2436d965026adad3ef7baba37f2183e9b5",
199-
))
200-
err(g2Isog3.c5.SetString(
201-
"0xf5d0d63d2797471e6d39f306cc0dc0ab85de3bd9f39ce46f3649ac0de9e844417cc8de88716c1fd323fa68040801aea",
202-
"0xab1c2ffdd6c253ca155231eb3e71ba044fd562f6f72bc5bad5ec46a0b7a3b0247cf08ce6c6317f40edbc653a72dee17",
203-
))
204207

205208
err(g2Isog3.xNum[0].SetString(
206209
"0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6",
@@ -259,23 +262,78 @@ func init() {
259262
"0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa99",
260263
))
261264
g2Isog3.yDen[3].SetOne()
265+
}
262266

263-
err(g1Check.beta0.SetString("0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac"))
264-
err(g1Check.beta1.SetString("0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe"))
267+
func initG1sswu() {
268+
g1sswu.Z.SetUint64(11)
269+
g1sswu.c1 = [48]byte{ // (big-endian)
270+
0x06, 0x80, 0x44, 0x7a, 0x8e, 0x5f, 0xf9, 0xa6,
271+
0x92, 0xc6, 0xe9, 0xed, 0x90, 0xd2, 0xeb, 0x35,
272+
0xd9, 0x1d, 0xd2, 0xe1, 0x3c, 0xe1, 0x44, 0xaf,
273+
0xd9, 0xcc, 0x34, 0xa8, 0x3d, 0xac, 0x3d, 0x89,
274+
0x07, 0xaa, 0xff, 0xff, 0xac, 0x54, 0xff, 0xff,
275+
0xee, 0x7f, 0xbf, 0xff, 0xff, 0xff, 0xea, 0xaa,
276+
}
277+
err(g1sswu.c2.SetString("0x3d689d1e0e762cef9f2bec6130316806b4c80eda6fc10ce77ae83eab1ea8b8b8a407c9c6db195e06f2dbeabc2baeff5"))
278+
}
265279

266-
g1Check.coef = [16]byte{0x39, 0x6c, 0x8c, 0x00, 0x55, 0x55, 0xe1, 0x56, 0x00, 0x00, 0x00, 0x00, 0x55, 0x55, 0x55, 0x55} // (big-endian)
280+
func initG2sswu() {
281+
g2sswu.Z[1].SetUint64(1)
282+
g2sswu.Z[0].SetUint64(2)
283+
g2sswu.Z.Neg()
284+
g2sswu.c1 = [95]byte{ // (big-endian)
285+
0x2a, 0x43, 0x7a, 0x4b, 0x8c, 0x35, 0xfc, 0x74,
286+
0xbd, 0x27, 0x8e, 0xaa, 0x22, 0xf2, 0x5e, 0x9e,
287+
0x2d, 0xc9, 0x0e, 0x50, 0xe7, 0x04, 0x6b, 0x46,
288+
0x6e, 0x59, 0xe4, 0x93, 0x49, 0xe8, 0xbd, 0x05,
289+
0x0a, 0x62, 0xcf, 0xd1, 0x6d, 0xdc, 0xa6, 0xef,
290+
0x53, 0x14, 0x93, 0x30, 0x97, 0x8e, 0xf0, 0x11,
291+
0xd6, 0x86, 0x19, 0xc8, 0x61, 0x85, 0xc7, 0xb2,
292+
0x92, 0xe8, 0x5a, 0x87, 0x09, 0x1a, 0x04, 0x96,
293+
0x6b, 0xf9, 0x1e, 0xd3, 0xe7, 0x1b, 0x74, 0x31,
294+
0x62, 0xc3, 0x38, 0x36, 0x21, 0x13, 0xcf, 0xd7,
295+
0xce, 0xd6, 0xb1, 0xd7, 0x63, 0x82, 0xea, 0xb2,
296+
0x6a, 0xa0, 0x00, 0x01, 0xc7, 0x18, 0xe3,
297+
}
298+
err(g2sswu.c2.SetString("0x00", "0x01"))
299+
err(g2sswu.c3.SetString(
300+
"0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2",
301+
"0x6af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09",
302+
))
303+
err(g2sswu.c4.SetString(
304+
"0x699be3b8c6870965e5bf892ad5d2cc7b0e85a117402dfd83b7f4a947e02d978498255a2aaec0ac627b5afbdf1bf1c90",
305+
"0x8157cd83046453f5dd0972b6e3949e4288020b5b8a9cc99ca07e27089a2ce2436d965026adad3ef7baba37f2183e9b5",
306+
))
307+
err(g2sswu.c5.SetString(
308+
"0xf5d0d63d2797471e6d39f306cc0dc0ab85de3bd9f39ce46f3649ac0de9e844417cc8de88716c1fd323fa68040801aea",
309+
"0xab1c2ffdd6c253ca155231eb3e71ba044fd562f6f72bc5bad5ec46a0b7a3b0247cf08ce6c6317f40edbc653a72dee17",
310+
))
311+
}
267312

268-
initPsi()
313+
func initSigma() {
314+
err(g1Sigma.beta0.SetString("0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac"))
315+
err(g1Sigma.beta1.SetString("0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe"))
269316
}
270317

271318
func initPsi() {
272-
g2PsiCoeff.minusZ = [8]byte{0xd2, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00} // (big-endian)
319+
// ratioKummer sets z = t/Frob(t) if it falls in Fp2, panics otherwise.
320+
ratioKummer := func(z *ff.Fp2, t *ff.Fp12) {
321+
var r ff.Fp12
322+
r.Frob(t)
323+
r.Inv(&r)
324+
r.Mul(t, &r)
325+
if r[1].IsZero() != 1 || r[0][1].IsZero() != 1 || r[0][2].IsZero() != 1 {
326+
err(errors.New("failure of result to be in Fp2"))
327+
}
328+
*z = r[0][0]
329+
}
330+
273331
w := &ff.Fp12{}
274332
w[1].SetOne()
275333
wsq := &ff.Fp12{}
276334
wsq.Sqr(w)
277-
ratioKummer(&g2PsiCoeff.alpha, wsq)
335+
ratioKummer(&g2Psi.alpha, wsq)
278336
wcube := &ff.Fp12{}
279337
wcube.Mul(wsq, w)
280-
ratioKummer(&g2PsiCoeff.beta, wcube)
338+
ratioKummer(&g2Psi.beta, wcube)
281339
}

‎ecc/bls12381/g1.go

+20-12
Original file line numberDiff line numberDiff line change
@@ -136,20 +136,28 @@ func (g *G1) cmov(P *G1, b int) {
136136
(&g.z).CMov(&g.z, &P.z, b)
137137
}
138138

139+
// sigma is an edomorphism defined by (x, y) → (βx, y) for some β ∈ Fp of
140+
// multiplicative order 3.
141+
func (g *G1) sigma(P *G1) { *g = *P; g.x.Mul(&g.x, &g1Sigma.beta0) }
142+
143+
// sigma2 is sigma(sigma(P)).
144+
func (g *G1) sigma2(P *G1) { *g = *P; g.x.Mul(&g.x, &g1Sigma.beta1) }
145+
139146
// isRTorsion returns true if point is in the r-torsion subgroup.
140147
func (g *G1) isRTorsion() bool {
141148
// Bowe, "Faster Subgroup Checks for BLS12-381" (https://eprint.iacr.org/2019/814)
142-
Q, _2sP, ssP := &G1{}, *g, *g
143-
144-
_2sP.x.Mul(&g.x, &g1Check.beta0) // s(P)
145-
_2sP.Double() // 2*s(P)
146-
ssP.x.Mul(&g.x, &g1Check.beta1) // s(s(P))
147-
Q.Add(g, &ssP) // P + s(s(P))
148-
Q.Neg() // -P - s(s(P))
149-
Q.Add(Q, &_2sP) // 2*s(P) - P - s(s(P))
150-
Q.scalarMultShort(g1Check.coef[:], Q) // coef * [2*s(P) - P - s(s(P))]
151-
ssP.Neg() // -s(s(P))
152-
Q.Add(Q, &ssP) // coef * [2*s(P) - P - s(s(P))] - s(s(P))
149+
Q, _2sP, ssP := &G1{}, &G1{}, &G1{}
150+
coef := bls12381.g1Check[:]
151+
152+
_2sP.sigma(g) // s(P)
153+
_2sP.Double() // 2*s(P)
154+
ssP.sigma2(g) // s(s(P))
155+
Q.Add(g, ssP) // P + s(s(P))
156+
Q.Neg() // -P - s(s(P))
157+
Q.Add(Q, _2sP) // 2*s(P) - P - s(s(P))
158+
Q.scalarMultShort(coef, Q) // coef * [2*s(P) - P - s(s(P))]
159+
ssP.Neg() // -s(s(P))
160+
Q.Add(Q, ssP) // coef * [2*s(P) - P - s(s(P))] - s(s(P))
153161

154162
return Q.IsIdentity()
155163
}
@@ -162,7 +170,7 @@ func (g *G1) isRTorsion() bool {
162170
// and because there are no points of order h^2. See Section 5 of Wahby-Boneh
163171
// "Fast and simple constant-time hashing to the BLS12-381 elliptic curve" at
164172
// https://eprint.iacr.org/2019/403
165-
func (g *G1) clearCofactor() { g.scalarMultShort(g1Params.cofactorSmall[:], g) }
173+
func (g *G1) clearCofactor() { g.scalarMultShort(bls12381.oneMinusZ[:], g) }
166174

167175
// Double updates g = 2g.
168176
func (g *G1) Double() {

0 commit comments

Comments
 (0)