G2 generator for BLS12-381 is undocumented

[ebfull]

relic/src/epx/relic_ep2_curve.c

Lines 98 to 101 in f97c36e

	#define B12_P381_X0 "173994825DB88350CA024FA3EE453F723D6E52ED7BEB8AFAE29D223009CA43711E3566E92069F13CE1038C795305A9DE"
	#define B12_P381_X1 "D886D66520D016D27C2699CF0CEBDC87D6EDA1D5B13C392DC327BA2E7FA21C30C8E1F93BD86419D3E594DA84E459FE3"
	#define B12_P381_Y0 "13FD60481C160DB73B3E3F3298CD68C99C9E8C5675A137D8AC42E2CE45CDA854704A539990E675012F6BB3662D7B18DC"
	#define B12_P381_Y1 "0C702DB9DA31B645452DC46A83C0C773A8E3292FDCD422FC4EA112D852190162339140BA78385F473782477E9A59E9F5"

How was this generator chosen?

Alternatively, change to use the generator:

#define B12_P381_X0		"024AA2B2F08F0A91260805272DC51051C6E47AD4FA403B02B4510B647AE3D1770BAC0326A805BBEFD48056C8C121BDB8"
#define B12_P381_X1		"13E02B6052719F607DACD3A088274F65596BD0D09920B61AB5DA61BBDC7F5049334CF11213945D57E5AC7D055D042B7E"
#define B12_P381_Y0		"0CE5D527727D6E118CC9CDC6DA2E351AADFD9BAA8CBDD3A76D429A695160D12C923AC9CC3BACA289E193548608B82801"
#define B12_P381_Y1		"0606C4A02EA734CC32ACD2B02BC28B99CB3E287E85A763AF267492AB572E99AB3F370D275CEC1DA1AAA9075FF05F79BE"

Obtained by "finding the lexicographically smallest valid x-coordinate, and its lexicographically smallest y-coordinate and scaling it by the cofactor such that the result is not the point at infinity."

[dfaranha]

Thanks! Can you please share the script used to pick the generator for independent verification?

[ebfull]

Here's a sage script I managed to find on my machine.

param = -0xd201000000010000

def r(x):
    return (x**4) - (x**2) + 1

def q(x):
    return (((x - 1) ** 2) * ((x**4) - (x**2) + 1) // 3) + x

def g1_h(x):
	return ((x-1)**2) // 3

def g2_h(x):
    return ((x**8) - (4 * (x**7)) + (5 * (x**6)) - (4 * (x**4)) + (6 * (x**3)) - (4 * (x**2)) - (4*x) + 13) // 9

q = q(param)
r = r(param)

Fq = GF(q)

ec = EllipticCurve(Fq, [0, 4])

def psqrt(v):
	assert(not v.is_zero())
	a = sqrt(v)
	b = -a
	if a < b:
		return a
	else:
		return b

for x in range(0,100):
	rhs = Fq(x)^3 + 4
	if rhs.is_square():
		y = psqrt(rhs)
		p = ec(x, y) * g1_h(param)
		if (not p.is_zero()) and (p * r).is_zero():
			print "g1 generator: %s" % p
			break

Fqx.<j> = PolynomialRing(Fq, 'j')
Fq2.<i> = GF(q^2, modulus=j^2 + 1)

ec2 = EllipticCurve(Fq2, [0, (4 * (1 + i))])

assert(ec2.order() == (r * g2_h(param)))

for x in range(0,100):
	rhs = (Fq2(x))^3 + (4 * (1 + i))
	if rhs.is_square():
		y = psqrt(rhs)
		p = ec2(Fq2(x), y) * g2_h(param)
		if (not p.is_zero()) and (p * r).is_zero():
			print "g2 generator: %s" % p
			break

Produces:

g1 generator: (3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507 : 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569 : 1)
g2 generator: (3059144344244213709971259814753781636986470325476647558659373206291635324768958432433509563104347017837885763365758*i + 352701069587466618187139116011060144890029952792775240219908644239793785735715026873347600343865175952761926303160 : 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582*i + 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905 : 1)

[dfaranha]

Thanks! The G2 generator is now the one provided here.