I have a 256bit signature and a certificate with a public key to verify it. I had little information about the signature scheme used, but I know now that it's "ECBNwithSHA256". I have never come across these Barreto-Naehrig Curves until now. My question to the community is: The certificate contains two point pairs (each 32 bytes) as the public key.

Can someone explain to me why the public key consists of 4 points here? This is a Screenshot of the certificate:


New contributor
biolightning is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 4 points or 4 bytes? – kelalaka Nov 8 at 14:19
  • 4 points, each 32 bytes long. As shown in the picture. The blackened parts are the points on the curve. (x,y) , (x,y) , (x,y) , (x,y) – biolightning Nov 8 at 14:27
  • 4 points (where 2 points are combined in a SEQUENCE) where each coordinate has 32 bytes. That would make the points 64 bytes in size. You would expect one octet string containing an uncompressed point for most curves. As I don't see any official ASN.1 specification of the public key, this key format could well be proprietary. But I don't know anything about this curve format, so I might well be mistaken. – Maarten Bodewes Nov 8 at 15:34
  • Related question here: somebody also looking for a definition of the data structure... (no answers when this comment was posted). – Maarten Bodewes Nov 8 at 15:41
  • OK, final comment I hope: your title and body seem at odds. I understand you need a public key to verify the signature, but understanding the format of the public key is not the same as "Need help verifying Barreto-Naehrig signature". Could you fix the title to reflect the actual question? – Maarten Bodewes Nov 8 at 16:00

It is common to define pairing-friendly curve such as Barreto-Naehrig on sextic twists to implement efficient pairings (https://eprint.iacr.org/2012/232.pdf). for example, $E(\mathbb{F}_p): y^2 = x^3 + 2$ and sextic twist $E'(\mathbb{F}_{p^2}): x'^3 + \frac{2}{s} = x'^3 + 1 - u, where ,\mathbb{F}_{p^2} = \mathbb{F}_p [u]/(u^2 + 1), \mathbb{F}_{p^6} = \mathbb{F}_{p^2} [v]/(v^3 - (1+u)), \mathbb{F}_{p^{12}}=\mathbb{F}_{p^6} [w]/(w^2 - v), 1/s = 1/(1 + u)$ So the public key may be a point on a curve defined over an extended field and thus the coordinates will have multiple components. I didn't get into your screenshot in detail but I think it may be a point on the curve over $\mathbb{F}_p^2$ and thus the coordinates $(x,y)$ have 2 components each which explains why you have components of 32 bytes each.

New contributor
Youssef El Housni is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

biolightning is a new contributor. Be nice, and check out our Code of Conduct.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.