Tezex.Crypto.BLS.Pairing (tezex v3.2.0)

View Source

BLS12-381 pairing operations implementing the Optimal ATE pairing.

This module provides the pairing function e: G1 × G2 → GT used for BLS signature verification. The pairing satisfies the bilinearity property: e(aP, bQ) = e(P, Q)^(ab).

This is a full implementation of the BLS12-381 pairing using Miller's algorithm and final exponentiation.

Summary

Types

gt()

Functions

apply_twist(map)

Applies the twist isomorphism to convert G2 points to FQ12. Field isomorphism from Z[p] / x2 to Z[p] / x2 - 2*x + 2

cast_point_to_fq12(map)

Casts a G1 point to Fq12 coordinates for line function evaluation.

final_exponentiation(miller_result)

Implements the final exponentiation step of the pairing. Uses the optimized BLS12-381 specific algorithm instead of naive exponentiation.

gt_eq?(a, b)

Checks if two GT elements are equal.

gt_identity()

Returns the identity element in GT.

gt_inv(gt_element)

Inverts a GT element.

gt_mul(a, b)

Multiplies two GT elements.

is_identity?(gt_element)

Checks if a GT element is the identity.

line_function_fq12(p1, p2, t)

Computes the line function for Miller's algorithm using Fq12 coordinates. This version works with twisted points that have Fq12 coordinates. Returns {numerator, denominator} to avoid unnecessary divisions.

miller_loop(q_point, p_point, final_exponentiate)

Implements the Miller loop for pairing computation. This is the core of the pairing algorithm.

pairing(g1_point, g2_point)

Computes the optimal ATE pairing of a G1 point and G2 point. Returns an element in GT = Fq12.

pairing(g1_point, g2_point, final_exponentiate)

Computes the pairing with optional final exponentiation.

pairing_check(pubkey_point, h_msg_point, g1_generator, signature_point)

Performs a pairing check for BLS signature verification.

Types

gt()

@type gt() :: Tezex.Crypto.BLS.Fq12.t()

Functions

apply_twist(map)

@spec apply_twist(Tezex.Crypto.BLS.G2.t()) :: %{
  x: Tezex.Crypto.BLS.Fq12.t(),
  y: Tezex.Crypto.BLS.Fq12.t(),
  z: Tezex.Crypto.BLS.Fq12.t()
}

Applies the twist isomorphism to convert G2 points to FQ12. Field isomorphism from Z[p] / x2 to Z[p] / x2 - 2*x + 2

cast_point_to_fq12(map)

@spec cast_point_to_fq12(Tezex.Crypto.BLS.G1.t()) :: %{
  x: Tezex.Crypto.BLS.Fq12.t(),
  y: Tezex.Crypto.BLS.Fq12.t(),
  z: Tezex.Crypto.BLS.Fq12.t()
}

Casts a G1 point to Fq12 coordinates for line function evaluation.

final_exponentiation(miller_result)

@spec final_exponentiation(gt()) :: gt()

Implements the final exponentiation step of the pairing. Uses the optimized BLS12-381 specific algorithm instead of naive exponentiation.

gt_eq?(a, b)

@spec gt_eq?(gt(), gt()) :: boolean()

Checks if two GT elements are equal.

gt_identity()

@spec gt_identity() :: gt()

Returns the identity element in GT.

gt_inv(gt_element)

@spec gt_inv(gt()) :: gt()

Inverts a GT element.

gt_mul(a, b)

@spec gt_mul(gt(), gt()) :: gt()

Multiplies two GT elements.

is_identity?(gt_element)

@spec is_identity?(gt()) :: boolean()

Checks if a GT element is the identity.

line_function_fq12(p1, p2, t)

@spec line_function_fq12(
  %{
    x: Tezex.Crypto.BLS.Fq12.t(),
    y: Tezex.Crypto.BLS.Fq12.t(),
    z: Tezex.Crypto.BLS.Fq12.t()
  },
  %{
    x: Tezex.Crypto.BLS.Fq12.t(),
    y: Tezex.Crypto.BLS.Fq12.t(),
    z: Tezex.Crypto.BLS.Fq12.t()
  },
  %{
    x: Tezex.Crypto.BLS.Fq12.t(),
    y: Tezex.Crypto.BLS.Fq12.t(),
    z: Tezex.Crypto.BLS.Fq12.t()
  }
) :: {Tezex.Crypto.BLS.Fq12.t(), Tezex.Crypto.BLS.Fq12.t()}

Computes the line function for Miller's algorithm using Fq12 coordinates. This version works with twisted points that have Fq12 coordinates. Returns {numerator, denominator} to avoid unnecessary divisions.

miller_loop(q_point, p_point, final_exponentiate)

@spec miller_loop(Tezex.Crypto.BLS.G2.t(), Tezex.Crypto.BLS.G1.t(), boolean()) :: gt()

Implements the Miller loop for pairing computation. This is the core of the pairing algorithm.

Core algorithm for optimal ATE pairing computation.

pairing(g1_point, g2_point)

@spec pairing(Tezex.Crypto.BLS.G1.t(), Tezex.Crypto.BLS.G2.t()) :: gt()

Computes the optimal ATE pairing of a G1 point and G2 point. Returns an element in GT = Fq12.

This implements the full BLS12-381 pairing algorithm:

  1. Miller loop computation
  2. Final exponentiation

pairing(g1_point, g2_point, final_exponentiate)

@spec pairing(Tezex.Crypto.BLS.G1.t(), Tezex.Crypto.BLS.G2.t(), boolean()) :: gt()

Computes the pairing with optional final exponentiation.

pairing_check(pubkey_point, h_msg_point, g1_generator, signature_point)

@spec pairing_check(
  Tezex.Crypto.BLS.G1.t(),
  Tezex.Crypto.BLS.G2.t(),
  Tezex.Crypto.BLS.G1.t(),
  Tezex.Crypto.BLS.G2.t()
) :: boolean()

Performs a pairing check for BLS signature verification.

Implements the actual BLS verification equation: e(signature, G1_generator) == e(H(msg), pubkey)

This is equivalent to checking: e(signature, G1_generator) * e(H(msg), -pubkey) == 1

Uses the full cryptographically secure pairing implementation.