bls12-381 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1398ff4737e7cc35aee61178bb064235e4f5765ec18a69511681c9389c1384a5
-  data.tar.gz: f6f386f4681e0cb3a3c642a0d5fa2e061fc9c96b4034c019cdf0e510020e059a
+  metadata.gz: 24158dde28a5367b3fd19c5d77dfeb70ba7429c43f501f1e15345dc5792cfcd2
+  data.tar.gz: ee9dd866975f45538e1bd4cfa044fd88741cd0e01176fc6dea075111eab88cfe
 SHA512:
-  metadata.gz: 7589e44db5a83ae84615cfbad287d7c36c3eb223186e3b0552755ef36ceff516b8fcf40a1f11fec534344d48db49f4277be8fdbb82eb16e5f972854334732818
-  data.tar.gz: b0d5fb49ba941dec4fe7e3eb892cc08036e10505bf6cc6e01f429cf3874219092aaffb530bd54e96ba48c7ce01aa59cd4774871c81d05b72282e76f3a78757be
+  metadata.gz: 1751863707f75ea0d6bcc0fe8d4e1e1da82fb9657256f4a272efb129288dfec205be049dd6dde478f96488dcbf083d9131ba50779f3467f364a2b6c8659e1f4a
+  data.tar.gz: f523b7e1d92e900b44aa395359a9fa2a98e701a381e5b217d934cd50fa9f194908f5789ee197047007e3b80f41cf2a67fcbbb224779219292b4c8ab557b4bfd7

data/CHANGELOG.md

@@ -1,5 +1,62 @@
 ## [Unreleased]
 
+## [0.5.0] - 2026-11-02
+
+### Fixed
+
+- `PointG2.from_hex` now rejects a coordinate at or above the field order. A coordinate written as `c + P` used to decode to the same point as `c`, giving one point several encodings.
+- `expand_message_xmd`, and so `hash_to_curve` with a custom `dst:`, handles a domain separation tag longer than 255 bytes by hashing it as RFC 9380 section 5.3.3 prescribes, instead of failing inside I2OSP.
+- Raising a field element to a negative power raises `ArgumentError`; `Fp2`, `Fp6` and `Fp12` used to answer with one.
+- `expand_message_xmd` computes exactly the blocks RFC 9380 asks for. It used to compute one more, which cost a SHA-256 per call and failed outright at the largest permitted length.
+- `==` on `Fp2`, `Fp6` and `Fp12` returns false for anything that is not the same kind of element instead of raising `NoMethodError`.
+- `==` on a point returns false for a point of the other group, nil or anything else that is not a point of the same group, instead of raising `BLS::PointError`.
+- `BLS.pairing` refuses a point outside the prime-order subgroup with `BLS::PointError`; it used to check only that the point was on the curve.
+
+### Changed
+
+- Scalar multiplication sizes its wNAF window table from the 255 bits of the group order rather than the base field, reduces the scalar modulo the order first, and skips zero windows instead of adding a throwaway point. `multiply` on G2 runs about three times faster and precompute tables shrink to a third.
+- Subgroup membership (`in_group?`, and so `from_hex`) uses the endomorphism tests of Scott's "A note on group membership tests for G1, G2 and GT on BLS pairing-friendly curves" in place of a multiplication by the group order.
+- `BLS::PointG1::MAX_BITS` and `BLS::PointG2::MAX_BITS` are gone; `BLS::ProjectivePoint::SCALAR_BITS` holds the width that matters.
+- `BLS.norm_p1` and `BLS.norm_p2`, which nothing used, are gone.
+- The `bigdecimal` dependency is gone.
+- Requires Ruby 3.3 or later, matching what is tested.
+- Depend on h2c 0.4.x, which no longer defines a top-level `BLS` module of its own.
+- `hash_to_curve` refuses an empty or non-string `dst:` with `BLS::Error` for both groups, as RFC 9380 section 3.1 requires, and anything the h2c gem raises for G1 arrives as `BLS::PointError` rather than `H2C::Error`.
+
+## [0.4.0] - 2026-08-10
+
+- Check that every parsed point lies in the prime-order subgroup.
+- Add the proof of possession scheme: `scheme:` on `sign`, `verify` and `verify_batch`, plus `pop_prove`, `pop_verify` and `fast_aggregate_verify`.
+- `verify_batch` handles repeated messages correctly and refuses them under `:basic`.
+- Verification returns false for the point at infinity instead of raising.
+- Validate G1 encodings as strictly as G2: infinity padding, flag and length consistency, reduced coordinates.
+- Validate hex input for points, messages and private keys instead of silently truncating or aliasing it.
+- `Field#invert` raises on zero instead of returning zero.
+- Fix `sgn0` to consult the second coordinate when the first is zero.
+- All exceptions descend from `BLS::Error`, with `BLS::PointError` and `BLS::PairingError` beneath it.
+- Add the bls12-381-tests and RFC 9380 test vectors. Document that nothing here is constant time.
+
+## [0.3.1] - 2026-04-24
+
+- Ruby 3.4 compatibility: depend on `bigdecimal` explicitly, follow the h2c gem's SSWU rename.
+
+## [0.3.0] - 2023-07-21
+
+- Support the compressed PointG2 format.
+- Fix the private key range check.
+
+## [0.2.2] - 2023-01-26
+
+- Add `BLS::Field#==` and `BLS::Field#to_s`.
+
+## [0.2.1] - 2023-01-16
+
+- Add argument validation and error message cleanup.
+
+## [0.2.0] - 2022-09-07
+
+- Add `BLS::PointG2.from_private_key`.
+
 ## [0.1.0] - 2021-03-29
 
 - Initial release

data/README.md

@@ -27,8 +27,8 @@ Or install it yourself as:
 ```ruby
 require 'bls'
 
-# Generate private key.
-private_key = SecureRandom.random_number(BLS::Curve::R - 1)
+# Generate private key: an integer in 1..(R - 1). Zero is not a key, so shift the range up.
+private_key = 1 + SecureRandom.random_number(BLS::Curve::R - 1)
 
 # Or you can use hex string.
 private_key = '67d53f170b908cabb9eb326c3c337762d59289a8fec79f7bc9254b584b73265c'
@@ -44,7 +44,7 @@ message = '64726e3da8'
 signature = BLS.sign(message, private_key)
 # signature is BLS::PointG2 object. You can get signature with hex format using #to_hex method.
 # If you want to use BLS::PointG1 signature, use BLS.sign(message, p, sig_type: :g1)
-signature.to_signature
+signature.to_hex(compressed: true)
 
 is_correct = BLS.verify(signature, message, public_key)
 => true
@@ -119,11 +119,13 @@ end
 Passing the wrong type or the wrong number of coefficients is a mistake in the calling code
 rather than a fact about a key, and raises `ArgumentError` as it would anywhere else in Ruby.
 
-Verification never raises over the data it is given. `BLS.verify`, `BLS.verify_batch`,
-`BLS.fast_aggregate_verify` and `BLS.pop_verify` return `false` for anything they will not
-accept, including the point at infinity and an empty set of signers, so untrusted input cannot
-turn into an exception. Deserializing that input with `from_hex` beforehand still raises, which
-is where a malformed encoding is caught.
+Verification does not raise over the keys and signatures it is given. `BLS.verify`,
+`BLS.verify_batch`, `BLS.fast_aggregate_verify` and `BLS.pop_verify` return `false` for any
+point they will not accept, including the point at infinity and an empty set of signers, so an
+untrusted key or signature cannot turn into an exception. Deserializing it with `from_hex`
+beforehand still raises, which is where a malformed encoding is caught. The message is
+different: it is the hex of a hash the caller computed, and one that is not hex, or has an odd
+number of digits, raises `BLS::PointError` from signing and verifying alike.
 
 ## Threads
 
@@ -164,4 +166,4 @@ The gem is available as open source under the terms of the [MIT License](https:/
 
 ## Code of Conduct
 
-Everyone interacting in the BlS12-381 project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/[USERNAME]/bls12-381/blob/master/CODE_OF_CONDUCT.md).
+Everyone interacting in the BLS12-381 project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the [code of conduct](https://github.com/azuchi/bls12-381/blob/main/CODE_OF_CONDUCT.md).

data/bls12-381.gemspec

@@ -12,7 +12,7 @@ Gem::Specification.new do |spec|
   spec.description   = 'BLS12-381 implementation for Ruby.'
   spec.homepage      = 'https://github.com/azuchi/bls12-381'
   spec.license       = 'MIT'
-  spec.required_ruby_version = Gem::Requirement.new('>= 2.4.0')
+  spec.required_ruby_version = Gem::Requirement.new('>= 3.3.0')
 
   spec.metadata['homepage_uri'] = spec.homepage
   spec.metadata['source_code_uri'] = spec.homepage
@@ -27,8 +27,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   # Uncomment to register a new dependency of your gem
-  spec.add_dependency "h2c", ">= 0.2.1", "< 0.3"
-  spec.add_dependency "bigdecimal"
+  spec.add_dependency "h2c", "~> 0.4.0"
 
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'rake', '>= 12.3.3'

data/lib/bls/field.rb

@@ -45,7 +45,10 @@ module BLS
       self.class.new(value**2)
     end
 
+    # @raise [ArgumentError] Occur when +n+ is negative. Divide by the positive power instead.
     def pow(n)
+      raise ArgumentError, 'Exponent must not be negative.' if n.negative?
+
       v = value.pow(n, self.class.const_get(:ORDER))
       self.class.new(v)
     end
@@ -130,6 +133,8 @@ module BLS
   module FQP
 
     def ==(other)
+      return false unless other.is_a?(self.class)
+
       coeffs == other.coeffs
     end
 
@@ -157,7 +162,11 @@ module BLS
       self.class.new(coeffs.map(&:negate))
     end
 
+    # @raise [ArgumentError] Occur when +n+ is negative, which the loop below would otherwise
+    # answer with ONE as though it had been zero.
     def pow(n)
+      raise ArgumentError, 'Exponent must not be negative.' if n.negative?
+
       one = self.class.const_get(:ONE)
       return one if n.zero?
       return self if n == 1

data/lib/bls/h2c.rb

@@ -3,18 +3,28 @@ module BLS
 
     LENGTH = 64
 
+    # Longest tag expand_message_xmd can carry as is; its length has to fit in one byte.
+    MAX_DST_LENGTH = 255
+    # Prefix under which a longer tag is hashed down to size, from RFC 9380 section 5.3.3.
+    OVERSIZE_DST_PREFIX = 'H2C-OVERSIZE-DST-'
+
     module_function
 
     # @param [String] message hash value with hex format.
     # @param [Integer] len_in_bytes length
     # @param [String] dst Domain separation tag. Mixing tags across schemes breaks the
     # domain separation the ciphersuites rely on, so it must always be passed explicitly.
+    # A tag longer than {MAX_DST_LENGTH} bytes is replaced by its hash, as RFC 9380 section
+    # 5.3.3 prescribes, so any length works and the result matches other implementations.
     # @return [Array[Integer]] byte array.
     # @raise BLS::Error
     def expand_message_xmd(message, len_in_bytes, dst)
-      b_in_bytes = BigDecimal(SHA256_DIGEST_SIZE)
+      raise BLS::Error, 'Domain separation tag must not be empty.' if dst.empty? # RFC 9380 section 3.1
+
+      dst = Digest::SHA256.digest(OVERSIZE_DST_PREFIX + dst) if dst.bytesize > MAX_DST_LENGTH
+      b_in_bytes = SHA256_DIGEST_SIZE
       r_in_bytes = b_in_bytes * 2
-      ell = (BigDecimal(len_in_bytes) / b_in_bytes).ceil
+      ell = (len_in_bytes + b_in_bytes - 1) / b_in_bytes
       raise BLS::Error, 'Invalid xmd length' if ell > 255
 
       dst_prime = dst.bytes + BLS.i2osp(dst.bytesize, 1)
@@ -24,7 +34,10 @@ module BLS
       payload = z_pad + [message].pack('H*').bytes + l_i_b_str + BLS.i2osp(0, 1) + dst_prime
       b_0 = Digest::SHA256.digest(payload.pack('C*'))
       b[0] = Digest::SHA256.digest((b_0.bytes + BLS.i2osp(1, 1) + dst_prime).pack('C*'))
-      (1..ell).each do |i|
+      # b[i] holds the RFC's b_(i + 1), so b_2 .. b_ell is ell - 1 more blocks. Running the
+      # loop to ell made one block too many: harmless after the truncation below, except that
+      # at ell == 255 its counter byte overflowed and the call failed at the RFC's own limit.
+      (1...ell).each do |i|
         args = BLS.bin_xor(b_0, b[i - 1]).bytes + BLS.i2osp(i + 1, 1) + dst_prime
         b[i] = Digest::SHA256.digest(args.pack('C*'))
       end
@@ -92,7 +105,7 @@ module BLS
       end
 
       # 3-isogeny map from E' to E
-      # Converts from Jacobi (xyz) to Projective (xyz) coordinates.
+      # Takes and returns projective (x, y, z) coordinates.
       def isogeny_map(x, y, z)
         mapped = Array.new(4, Fp2::ZERO)
         z_powers = [z, z**2, z**3]

data/lib/bls/pairing.rb

@@ -6,6 +6,9 @@ module BLS
   # @param [Boolean] with_final_exp
   # @return [BLS::Fp12]
   # @raise [BLS::PairingError] Occur when p.zero? or q.zero?
+  # @raise [BLS::PointError] Occur when either point is off its curve or outside its
+  # prime-order subgroup. from_hex has already checked what it returns; this is for points
+  # built by hand, for which the pairing would otherwise be computed without complaint.
   # @raise [ArgumentError]
   def pairing(p, q, with_final_exp: true)
     raise ArgumentError, 'p should be BLS::PointG1 object' unless p.is_a?(BLS::PointG1)
@@ -14,6 +17,8 @@ module BLS
 
     p.validate!
     q.validate!
+    p.validate_group!
+    q.validate_group!
     looped = p.miller_loop(q)
     with_final_exp ? looped.final_exponentiate : looped
   end

data/lib/bls/point/g1.rb

@@ -11,7 +11,6 @@ module BLS
 
     BASE = PointG1.new(Fp.new(Curve::G_X), Fp.new(Curve::G_Y), Fp::ONE)
     ZERO = PointG1.new(Fp::ONE, Fp::ONE, Fp::ZERO)
-    MAX_BITS = Fp::MAX_BITS
 
     # Parse PointG1 from form hex.
     # @param [String] hex hex value of PointG1.
@@ -106,10 +105,30 @@ module BLS
     def self.hash_to_curve(message, scheme: :basic, dst: nil)
       validate_hex!(message)
 
-      h2c = ::H2C.get(::H2C::Suite::BLS12381G1_XMDSHA256_SSWU_RO_, dst || self.dst(scheme))
+      h2c = ::H2C.get(::H2C::Suite::BLS12381G1_XMDSHA256_SSWU_RO_, resolve_dst(dst, scheme))
       p = h2c.digest([message].pack('H*'))
 
       PointG1.new(Fp.new(p.x), Fp.new(p.y), Fp::ONE)
+    rescue ::H2C::Error => e
+      # Whatever the h2c gem objects to, callers rescue it the way they rescue the rest.
+      raise PointError, e.message
+    end
+
+    # A primitive cube root of unity in Fp. (x, y) -> (BETA * x, y) is an endomorphism of E(Fp)
+    # that acts on G1 as multiplication by -z**2, z being the curve parameter. Of the two
+    # primitive roots, this is the one for which that holds; the other gives the inverse map.
+    ENDO_BETA = Fp.new(PSI2_C1).square
+
+    # Check whether this point belongs to G1, by the test of section 4 of
+    # https://eprint.iacr.org/2021/1130: a point of E(Fp) satisfies phi(P) == [-z**2]P exactly
+    # when it lies in G1. Two multiplications by the 64-bit z, with its six set bits, instead
+    # of one by the 255-bit r.
+    # @return [Boolean] true if this point is in G1.
+    def in_group?
+      return true if zero?
+
+      endo = PointG1.new(x * ENDO_BETA, y, z)
+      endo == multiply_unsafe(Curve::X).multiply_unsafe(Curve::X).negate
     end
 
     # Validate this point whether on curve over Fp.

data/lib/bls/point/g2.rb

@@ -11,7 +11,6 @@ module BLS
     KEY_SIZE_COMPRESSED = 96
     KEY_SIZE_UNCOMPRESSED = 192
 
-    MAX_BITS = Fp2::MAX_BITS
     BASE = PointG2.new(Fp2.new(Curve::G2_X), Fp2.new(Curve::G2_Y), Fp2::ONE)
     ZERO = PointG2.new(Fp2::ONE, Fp2::ONE, Fp2::ZERO)
 
@@ -45,6 +44,11 @@ module BLS
                 return ZERO if i_bit == POINT_INFINITY_FLAG
                 x1 = bytes[0...PUBLIC_KEY_LENGTH].unpack1('H*').to_i(16)
                 x0 = bytes[PUBLIC_KEY_LENGTH...(2 * PUBLIC_KEY_LENGTH)].unpack1('H*').to_i(16)
+                # Fp.new reduces modulo P, so without this check x + P would decode as the same
+                # point under a second encoding. G1 refuses these too.
+                unless x0 < Curve::P && x1 < Curve::P
+                  raise PointError, 'Invalid point G2, coordinates must be less than the field order.'
+                end
                 x = Fp2.new([x0, x1])
                 right = x ** 3 + Fp2.new(Curve::B2)
                 y = right.sqrt
@@ -66,6 +70,9 @@ module BLS
                 x0 = bytes[PUBLIC_KEY_LENGTH...(2 * PUBLIC_KEY_LENGTH)].unpack1('H*').to_i(16)
                 y1 = bytes[(2 * PUBLIC_KEY_LENGTH)...(3 * PUBLIC_KEY_LENGTH)].unpack1('H*').to_i(16)
                 y0 = bytes[(3 * PUBLIC_KEY_LENGTH)..-1].unpack1('H*').to_i(16)
+                unless [x0, x1, y0, y1].all? { |c| c < Curve::P }
+                  raise PointError, 'Invalid point G2, coordinates must be less than the field order.'
+                end
                 PointG2.new(Fp2.new([x0, x1]), Fp2.new([y0, y1]), Fp2::ONE)
               else
                 raise PointError, 'Invalid point G2, compression flag does not match the encoded length.'
@@ -93,7 +100,7 @@ module BLS
     def self.hash_to_curve(message, scheme: :basic, dst: nil)
       validate_hex!(message)
 
-      u = BLS::H2C::G2.hash_to_field(message, dst || self.dst(scheme))
+      u = BLS::H2C::G2.hash_to_field(message, resolve_dst(dst, scheme))
       q0 = PointG2.new(*BLS::H2C::G2.isogeny_map(*BLS::H2C::G2.map_to_curve_sswu(u[0])))
       q1 = PointG2.new(*BLS::H2C::G2.isogeny_map(*BLS::H2C::G2.map_to_curve_sswu(u[1])))
       r = q0 + q1
@@ -140,6 +147,20 @@ module BLS
       to_hex(compressed: true)
     end
 
+    # Check whether this point belongs to G2, by the test of section 4 of
+    # https://eprint.iacr.org/2021/1130: psi, the untwist-Frobenius-twist endomorphism that
+    # {clear_cofactor} also uses, acts on G2 as multiplication by the curve parameter z, and a
+    # point of E'(Fp2) satisfies psi(P) == [z]P exactly when it lies in G2. z is negative for
+    # BLS12-381 and Curve::X holds its magnitude, hence the negate. One multiplication by a
+    # 64-bit scalar with six set bits instead of one by the 255-bit r.
+    # @return [Boolean] true if this point is in G2.
+    def in_group?
+      return true if zero?
+
+      psi = from_affine_tuple(BLS.psi(*to_affine))
+      psi == multiply_unsafe(Curve::X).negate
+    end
+
     def validate!
       b = Fp2.new(Curve::B2)
       return if zero?

data/lib/bls/point.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require 'bigdecimal'
 require 'h2c'
 
 module BLS
@@ -16,6 +15,11 @@ module BLS
   # Abstract Point class that consist of projective coordinates.
   class ProjectivePoint
 
+    # Bits in the group order r. Every point this library hands out lies in the subgroup of
+    # that order, where [n]P == [n mod r]P, so this, not the size of the base field, is what
+    # a scalar multiplication has to cover.
+    SCALAR_BITS = Curve::R.bit_length
+
     attr_reader :x, :y, :z
     attr_accessor :m_precomputes
 
@@ -40,6 +44,22 @@ module BLS
       end
     end
 
+    # The tag {hash_to_curve} will use: the +dst+ given, or the one +scheme+ names.
+    # An empty tag is refused here, under BLS::Error, for both groups alike. RFC 9380 section
+    # 3.1 forbids it, and left to the layers below it would either go through unnoticed (G2)
+    # or surface as the h2c gem's own exception (G1), outside this library's hierarchy.
+    # @param [String, nil] dst explicit domain separation tag, if any.
+    # @param [Symbol] scheme signature scheme to take the tag from otherwise.
+    # @return [String] domain separation tag.
+    # @raise [BLS::Error] Occur when the tag is empty or not a string, or the scheme unknown.
+    def self.resolve_dst(dst, scheme)
+      return self.dst(scheme) if dst.nil?
+      raise BLS::Error, 'Domain separation tag must be a string.' unless dst.is_a?(String)
+      raise BLS::Error, 'Domain separation tag must not be empty.' if dst.empty?
+
+      dst
+    end
+
     # Check that +hex+ is a whole number of bytes written in hex, for {from_hex} and
     # {hash_to_curve}, which both unpack their argument with pack('H*').
     #
@@ -73,11 +93,13 @@ module BLS
       self.class.new(x, y, z)
     end
 
-    # Compare one point to another.
+    # Compare one point to another. A G1 point never equals a G2 point, nil, or anything
+    # else that is not a point of the same group, and says so with false rather than an
+    # exception, since Array#include?, uniq and the like call this on whatever they hold.
     # @param [ProjectivePoint] other another point.
     # @return [Boolean] whether same point or not.
     def ==(other)
-      raise PointError, "ProjectivePoint#==: this is #{self.class}, but other is #{other.class}" unless self.class == other.class
+      return false unless other.is_a?(self.class)
 
       (x * other.z) == (other.x * z) && (y * other.z) == (other.y * z)
     end
@@ -163,6 +185,9 @@ module BLS
     # Being on the curve is not sufficient: E(Fp) and E'(Fp2) both contain points
     # outside the order-r subgroup, and accepting them makes keys and signatures malleable.
     # Since r**2 does not divide the group order, [r]P == O holds only for P in the subgroup.
+    # That is the definition and the reference the specs compare against; PointG1 and PointG2
+    # override it with an endomorphism check that reaches the same answer in a fraction of
+    # the time.
     # @return [Boolean] true if this point is in the prime-order subgroup.
     def in_group?
       zero? || multiply_unsafe(Curve::R).zero?
@@ -217,24 +242,35 @@ module BLS
 
     # Scalar multiplication using wNAF.
     #
-    # This is NOT constant time, despite what {multiply_unsafe} implies by contrast. wNAF
-    # gives every window an addition, but the point it adds is read at an index derived from
-    # the scalar, and the additions themselves branch on whether an operand is the identity
-    # or the two are equal. Underneath, Ruby's bignum arithmetic and the modulo in Fp both run
-    # in time that depends on their operands. Anything the scalar decides is therefore visible
-    # to something watching timing or cache behaviour, which matters here because #sign and
-    # .from_private_key reach this with the private key. See the README.
+    # This is NOT constant time, despite what {multiply_unsafe} implies by contrast. The
+    # number of additions follows the number of non-zero windows in the scalar, the point
+    # each one adds is read at an index derived from the scalar, and the additions themselves
+    # branch on whether an operand is the identity or the two are equal. Underneath, Ruby's
+    # bignum arithmetic and the modulo in Fp both run in time that depends on their operands.
+    # Anything the scalar decides is therefore visible to something watching timing or cache
+    # behaviour, which matters here because #sign and .from_private_key reach this with the
+    # private key. See the README.
+    #
+    # noble, which this follows, adds a throwaway point on every zero window so that each
+    # window costs one addition whatever its digit. That buys nothing here, where the
+    # arithmetic underneath is not constant time to begin with, so the zero windows are
+    # skipped and the work saved instead.
     def multiply(scalar)
       n = scalar.is_a?(Field) ? scalar.value : scalar
       raise PointError, 'Invalid scalar, expected positive integer' if n <= 0
-      raise PointError, "Scalar has more bits than maxBits, shouldn't happen" if n.bit_length > max_bits
 
-      wNAF(n).first
+      # Reduced modulo r so that wNAF has {SCALAR_BITS} bits to walk, whatever was passed in.
+      # The table used to be sized from the base field instead, 381 bits for G1 and 762 for
+      # G2, and every window past the scalar's top bit was a wasted addition.
+      n %= Curve::R
+      return zero if n.zero?
+
+      wNAF(n)
     end
     alias * multiply
 
     def precomputes_window(w)
-      windows = (BigDecimal(max_bits) / w).ceil
+      windows = window_count(w)
       window_size = 2**(w - 1)
       points = []
       p = self
@@ -250,8 +286,17 @@ module BLS
       points
     end
 
-    def max_bits
-      self.class.const_get(:MAX_BITS)
+    # Number of width-+w+ windows that {wNAF} walks and {precomputes_window} must cover.
+    #
+    # One bit more than the scalar has. A window whose digit comes out above 2**(w - 1) is
+    # recoded as a negative digit and carries 1 into the next window, and when the top
+    # window of the scalar does that, the carry needs a window of its own or it is dropped
+    # on the floor. With r's top five bits being 11100, a width of 5 hits this for about
+    # four scalars in ten.
+    # @param [Integer] w window width.
+    # @return [Integer] window count.
+    def window_count(w)
+      (SCALAR_BITS + w) / w
     end
 
     def normalize_z(points)
@@ -285,8 +330,7 @@ module BLS
     def wNAF(n)
       w, precomputes = m_precomputes || [1, precomputes_window(1)]
       p = zero
-      f = zero
-      windows = (BigDecimal(max_bits) / w).ceil
+      windows = window_count(w)
       window_size = 2**(w - 1)
       mask = (2**w - 1)
       max_number = 2**w
@@ -299,27 +343,17 @@ module BLS
           wbits -= max_number
           n += 1
         end
-        if wbits.zero?
-          f += (window % 2 ? precomputes[offset].negate : precomputes[offset])
-        else
-          cached = precomputes[offset + wbits.abs - 1]
-          p += (wbits.negative? ? cached.negate : cached)
-        end
+        next if wbits.zero?
+
+        cached = precomputes[offset + wbits.abs - 1]
+        p += (wbits.negative? ? cached.negate : cached)
       end
-      [p, f]
+      p
     end
   end
 
   module_function
 
-  def norm_p1(point)
-    point.is_a?(PointG1) ? point : PointG1.from_hex(point)
-  end
-
-  def norm_p2(point)
-    point.is_a?(PointG2) ? point : PointG2.from_hex(point)
-  end
-
   def norm_p1h(point, scheme: :basic)
     point.is_a?(PointG1) ? point : PointG1.hash_to_curve(point, scheme: scheme)
   end

data/lib/bls/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BLS
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bls12-381
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Shigeyuki Azuchi
@@ -13,36 +13,16 @@ dependencies:
   name: h2c
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.2.1
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: 0.4.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 0.2.1
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '0.3'
-- !ruby/object:Gem::Dependency
-  name: bigdecimal
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.4.0
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -115,7 +95,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="