# Need help understanding public key format of Barreto-Naehrig signature

I have a 256bit signature and a certificate with a public key to verify it. I had little information about the signature scheme used, but I know now that it's "ECBNwithSHA256". I have never come across these Barreto-Naehrig Curves until now. My question to the community is: The certificate contains two point pairs (each 32 bytes) as the public key.

Can someone explain to me why the public key consists of 4 points here? This is a Screenshot of the certificate:

New contributor
biolightning is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
• 4 points or 4 bytes? – kelalaka Nov 8 at 14:19
• 4 points, each 32 bytes long. As shown in the picture. The blackened parts are the points on the curve. (x,y) , (x,y) , (x,y) , (x,y) – biolightning Nov 8 at 14:27
• 4 points (where 2 points are combined in a SEQUENCE) where each coordinate has 32 bytes. That would make the points 64 bytes in size. You would expect one octet string containing an uncompressed point for most curves. As I don't see any official ASN.1 specification of the public key, this key format could well be proprietary. But I don't know anything about this curve format, so I might well be mistaken. – Maarten Bodewes Nov 8 at 15:34
• Related question here: somebody also looking for a definition of the data structure... (no answers when this comment was posted). – Maarten Bodewes Nov 8 at 15:41
• OK, final comment I hope: your title and body seem at odds. I understand you need a public key to verify the signature, but understanding the format of the public key is not the same as "Need help verifying Barreto-Naehrig signature". Could you fix the title to reflect the actual question? – Maarten Bodewes Nov 8 at 16:00

It is common to define pairing-friendly curve such as Barreto-Naehrig on sextic twists to implement efficient pairings (https://eprint.iacr.org/2012/232.pdf). for example, $$E(\mathbb{F}_p): y^2 = x^3 + 2$$ and sextic twist $$E'(\mathbb{F}_{p^2}): x'^3 + \frac{2}{s} = x'^3 + 1 - u, where ,\mathbb{F}_{p^2} = \mathbb{F}_p [u]/(u^2 + 1), \mathbb{F}_{p^6} = \mathbb{F}_{p^2} [v]/(v^3 - (1+u)), \mathbb{F}_{p^{12}}=\mathbb{F}_{p^6} [w]/(w^2 - v), 1/s = 1/(1 + u)$$ So the public key may be a point on a curve defined over an extended field and thus the coordinates will have multiple components. I didn't get into your screenshot in detail but I think it may be a point on the curve over $$\mathbb{F}_p^2$$ and thus the coordinates $$(x,y)$$ have 2 components each which explains why you have components of 32 bytes each.