As far as I understand, the elliptic curve group based on BLS12-381 is prime order and cyclic. Thus, any group element could be used to generate all the elements of the group.
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
Yes, by Lagrange's Theorem in the group theory, the order of any element must divide the order of the group. Therefore, except for the identity element, which has order 1, all other points can be a generator.
If you define a protocol, you need a common agreement and the generator is a part of this. If you don't include it in the specifications you need to agree for every user. Instead of this, one point is assigned as the basepoint.
Normally the base points are selected in the manner of nothing-up-my-sleeve-numbers to show that there are no backdoors designed. The choice reason is given as
The generators of G1 and G2 are computed by finding the lexicographically smallest valid x-coordinate, and its lexicographically smallest y-coordinate and scaling it by the cofactor such that the result is not the point at infinity.
BLS12-381 is used for digital signatures and zero-knowledge proofs in Zcash, Ethereum 2.0, Skale, Algorand, Dfinity, Chia, and more.
answered Mar 2, 2021 at 23:25
$\begingroup$
$\endgroup$
Why is a point explicitly hard-coded as the generator of the group
Because, while any non-neutral element would serve as a generator, there has to be an agreement about which generator would be used (at least for most cryptographical operations).
To take the simplest case, consider DH (not that you'd want to use BLS12-381 to do DH); one side picks a random value $a$ and transmits $a \cdot G$; the other side picks a random value $b$ and transmits $b \cdot G$; the both compute the common value $ab \cdot G$.
For this to work, both sides need to agree on what $G$ is; if one uses a point $G$ and the other uses a point $G'$, it doesn't work.
