Skip to main content

Try it Live

Run BLS12-381 examples in the interactive playground
Future Plans: This page is planned and under active development. Examples are placeholders and will be replaced with accurate, tested content.

G1 Operations

G1 is the base field elliptic curve group used for BLS signatures. Points are 48 bytes compressed or 96 bytes uncompressed.

G1 Curve Equation

Base Field: Fp (381-bit prime) Group Order: r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001 Cofactor: h = 1 (prime order group)

Point Formats

Uncompressed (96 bytes, padded to 128 for precompiles)

Compressed (48 bytes)

MSB flags:
  • Bit 7: compression flag (1)
  • Bit 6: infinity flag
  • Bit 5: y-coordinate sign
  • Bits 0-4: part of x-coordinate

Operations

Point Addition

Add two G1 points using EIP-2537 format:
Gas Cost: 500 (EIP-2537) Time: ~15 μs (native)

Scalar Multiplication

Multiply G1 point by scalar:
Algorithm: GLV (Gallant-Lambert-Vanstone) endomorphism Gas Cost: 12,000 (EIP-2537) Time: ~80 μs (native)

Multi-Scalar Multiplication (MSM)

Compute sum(scalar_i * point_i) efficiently:
Algorithm: Pippenger’s algorithm Gas Cost: Variable (discount for batch) Time: ~8ms for 100 points (vs ~8ms for 100 individual muls)

Infinity Point

Point at infinity is the identity element:

Subgroup Membership

All points in G1 are in the prime-order subgroup (cofactor = 1). No additional subgroup check needed beyond curve equation validation.

Performance

Native (BLST on x86_64):
  • Addition: ~15 μs
  • Doubling: ~12 μs
  • Scalar mul: ~80 μs
  • MSM (100): ~8 ms (~80 μs per point)
  • MSM (1000): ~45 ms (~45 μs per point)
Speedup Techniques:
  • Endomorphism decomposition (GLV)
  • Precomputed multiples
  • Batch inversion for affine conversion

Use Cases

  • BLS signature storage (48 bytes compressed)
  • Message hashing (hash-to-curve → G1)
  • Signature aggregation (G1 addition)
  • Proof generation (MSM for commitment schemes)