2
$\begingroup$

As far as I understand, the elliptic curve group based on BLS12-381 is prime order and cyclic. Thus, any group element could be used to generate all the elements of the group.

  • Why is a point explicitly hard-coded as the generator of the group here and here?
  • If any group element serves as a generator of the group, what is the specialty of the chosen points in the above libraries? And how would one compute that special point?
$\endgroup$
4
$\begingroup$

Yes, by Lagrange's Theorem in the group theory, the order of any element must divide the order of the group. Therefore, except for the identity element, which has order 1, all other points can be a generator.

If you define a protocol, you need a common agreement and the generator is a part of this. If you don't include it in the specifications you need to agree for every user. Instead of this, one point is assigned as the basepoint.

Normally the base points are selected in the manner of nothing-up-my-sleeve-numbers to show that there are no backdoors designed. The choice reason is given as

The generators of G1 and G2 are computed by finding the lexicographically smallest valid x-coordinate, and its lexicographically smallest y-coordinate and scaling it by the cofactor such that the result is not the point at infinity.

BLS12-381 is used for digital signatures and zero-knowledge proofs in Zcash, Ethereum 2.0, Skale, Algorand, Dfinity, Chia, and more.

$\endgroup$
3
$\begingroup$

Why is a point explicitly hard-coded as the generator of the group

Because, while any non-neutral element would serve as a generator, there has to be an agreement about which generator would be used (at least for most cryptographical operations).

To take the simplest case, consider DH (not that you'd want to use BLS12-381 to do DH); one side picks a random value $a$ and transmits $a \cdot G$; the other side picks a random value $b$ and transmits $b \cdot G$; the both compute the common value $ab \cdot G$.

For this to work, both sides need to agree on what $G$ is; if one uses a point $G$ and the other uses a point $G'$, it doesn't work.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.