BLS12381
This is a nonexhaustive introduction to some of the key characteristics of the elliptic curve BLS12381. For further reading have a look at BLS12381For The Rest Of Us or the announcement.
Origin
BLS12381 was proposed by Sean Bowe in 2017 and is part of a group of elliptic curves described by Barreto, Lynn and Scott (hence BLS) back in 2002.
The curve is defined by the equation:
The points on the curve are pairs
For example: The point
Curve Definition
Other than our curves from back in school, which commonly had coordinates in the real numbers
which is in hexadecimal is
This prime number is exactly 381 bits long (hence 381).
The field
So
At this point we have an elliptic curve (let’s call it
We call this the group of
Subgroup of Elliptic Curve Points
The group of
So with the point
The number
which in hexadecimal is
Because
BLS Scalar
Since every point in BlsScalar
and we often write it framed with square brackets
In our cryptographic scheme we often use the BlsScalar
Embedding degree
The 12 in BLS12381 refers to the embedding degree ^{6}. But what exactly is the embedding degree? To explore that we need to have a look at elliptic curve pairings. However, since this is an introduction to the BLS12381 curve and not to elliptic curve pairings, we won’t go into too much detail here. For further reading please check out Pairings for Beginners.
So this is only a short summary on those aspects of elliptic curve pairing that help us understand the embedding degree.
Elliptic curve pairing
A pairing is a function that takes a point from a group
One of the most important properties of pairings is that for points
From this we can deduce that for two integers BlsScalar
We use this property in nearly all of our cryptographic schemes.
The groups
Then what about
Let’s start by looking at
Extension Fields
Do you remember the complex numbers
For all complex numbers
Sometimes we also write
We say that the complex numbers are a quadratic extension of the real numbers and it is easy to see that the real numbers are a subset of the complex numbers (when
We can not extend the complex numbers any further ^{8}, but that is a different story for finite fields.
Roots of Unity
Moreover, we can construct the 12th extension field
This group is defined as follows:
with
To understand what that means, let’s give an example.
Over the field
With what we learned so far, we can now formally define the embedding degree as the smallest integer
Twists
Now we have
As it turns out, our group of curve points
But the group
In this case the coordinates
The problem that we are facing now, is that doing any kind of arithmetic with points in
A twist can be seen as a function that maps points from one elliptic curve
The points in
This means that for easier arithmetic we can use that subgroup of
Summary
BLS12381 is a pairing friendly elliptic curve with an embedding degree of 12.
The coordinates of points on that curve are elements of the finite field
The groups of order
which is a subset of the curve
which is a subset of the curve
which is the group of th roots of unity in .
Footnotes

Note that this is not the point at
. ↩ 
This is not the same as our curve being defined over
. Generally speaking, an elliptic curve of the form is said to be defined over a field if the parameters and are in but not necessarily the coordinates and . This is denoted by . In the case of BLS12381 however, the curve is both defined over the field (so ) and has coordinates in the field (so ). ↩ 
This is a direct consequence of Lagrange’s Theorem. ↩

Check the crate documentation on how the generator is chosen. ↩

In order to ease the arithmetics with
BlsScalar
we still do some tricks under the hood. So even thoughBlsScalar
essentially are just integers fromto , internally we multiply them with and take the resulting number modulo . This is called the Montgomery form of the BlsScalar
and to add to the complexity we store that scalar in its Montgomery form the other way round (i.e. in little endian). ↩ 
Indeed the curve has been specifically designed to have an embedding degree of 12, which is a compromise between security (the higher the better) and performance (the lower the better). ↩

Depending on what the pairing scheme is used for,
can also be set to instead of . ↩ 
This is due to the fact that there are no irreducible polynomials with a degree
over the complex numbers and what that means is explained rather nicely here. ↩