# Understanding BLS12-381 Curve

I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it.

The things that I think I understand:

• The order of the curve is $≈2^{381}$
• The security level of the curve is 126 bits

The things that I don't understand:

• What is the size of the private key for this curve? Assuming I'm right about the order, is it 381 bits?
• The materials mention two generator points which produce public keys of different size - why is that? Shouldn't all points on the curve be of the same size?
• What exactly is the subgroup $r$ and what is its significance?

The 12 in BLS12-381 means that the embedding degree is 12 and the 381 means that the prime in the finite field $$\mathbb{F}_p$$ is of 381 bits. Now talking about your bulletpoints:
• The order is not $$\approx 2^{381}$$. The order is the number of points on the curve. A naive way is to find the coordinates $$y$$ in the equation $$y^2=x^3+4$$ for $$x\in \{0, p-1\}$$, or a better way you can run Schoof's algorithm.
• The security level is around $$128$$ bits. In fact, you need a subgroup of order $$r \approx 256$$ bits to have this security level because Pollard's $$\rho$$ attack (the fastest known algorithm to find discrete logs on elliptic curves) has a complexity $$\approx \mathcal{O}(\sqrt{r})$$ and indeed for BLS12-381 $$r \approx 2^{256}$$.
• The private key is a scalar in $$\mathbb{F}_p$$ which means $$\in \{0, p-1\}$$. So yes the size is $$381$$ bits.
• @lovesh Let’s denote the curve order $n$. Neither $q$ nor $r$ are the curve order. $q$ is the base field modulus and the gap between $q$ and $n$ is at most $2\sqrt{q}$ (Hasse’s theorem). $r$ is the subgroup order which divides divides $n$ (Lagrange’s theorem). Dec 30, 2018 at 17:01
• @YoussefElHousni Ok, so the total number of points on the curve are n but the number of points we work with is r so if if we are doing Diffie-Hellman we always check that the incoming point is in this subgroup of order r? Dec 31, 2018 at 6:55