### Cargo.toml Dependencies for blstrs

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Example Cargo.toml entries for including blstrs with different features. Choose the feature set that matches your project's requirements, such as serde for serialization or portable for builds without assembly.

```toml
# blstrs = { version = "0.7", features = ["serde"] }     # Serde serialization
# blstrs = { version = "0.7", features = ["portable"] }  # Portable blst (no assembly)
# blstrs = { version = "0.7", features = ["gpu"] }       # GPU (ec-gpu) support
```

--------------------------------

### Enable Portable BLST Builds

Source: https://github.com/filecoin-project/blstrs/blob/master/README.md

Build the blst dependency with the 'portable' feature enabled for enhanced portability across different systems.

```bash
--features portable
```

--------------------------------

### Initialize KaTeX Rendering in HTML

Source: https://github.com/filecoin-project/blstrs/blob/master/katex-header.html

Include this JavaScript snippet in your HTML to automatically render mathematical expressions using KaTeX when the DOM is ready. It configures KaTeX to recognize various delimiters for inline and display math.

```javascript
document.addEventListener("DOMContentLoaded", function() { renderMathInElement(document.body, { delimiters: [ {left: "$$\", right: "$$\", display: true}, {left: "\\(\", right: "\\)\", display: false}, {left: "$\", right: "$\", display: false}, {left: "\\[\", right: "\\]\", display: true} ] }); });
```

--------------------------------

### Run Benchmarks with Private Feature

Source: https://context7.com/filecoin-project/blstrs/llms.txt

To run benchmarks, you need to enable the private 'bench' feature. This command executes the benchmark suite for the blstrs library.

```bash
cargo bench --features __private_bench
```

--------------------------------

### Run Benchmarks with Private Features

Source: https://github.com/filecoin-project/blstrs/blob/master/README.md

Execute benchmarks for the blst library. Requires the `__private_bench` feature to be enabled.

```bash
$ cargo bench --features __private_bench
```

--------------------------------

### Bilinear Pairing Operations

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Demonstrates the usage of the optimal Ate pairing function `e: G1 × G2 → Gt`. Shows both standalone `pairing()` and `Engine` trait implementations, and verifies bilinearity and negation properties.

```rust
use blstrs::{Bls12, G1Affine, G2Affine, Gt, Scalar, pairing};
use group::prime::PrimeCurveAffine;
use pairing_lib::Engine;
use ff::Field;

let g1 = G1Affine::generator();
let g2 = G2Affine::generator();

// Direct pairing
let p = pairing(&g1, &g2);
assert_ne!(p, Gt::identity());

// Via Engine trait
let p2 = Bls12::pairing(&g1, &g2);
assert_eq!(p, p2);

// Bilinearity: e(aG1, bG2) == e(G1, G2)^(a*b)
let a = Scalar::from_u64s_le(&[1, 2, 3, 4]).unwrap().invert().unwrap().square();
let b = Scalar::from_u64s_le(&[5, 6, 7, 8]).unwrap().invert().unwrap().square();
let ab = a * b;

let ag1 = G1Affine::from(G1Affine::generator() * a);
let bg2 = G2Affine::from(G2Affine::generator() * b);

let lhs = pairing(&ag1, &bg2);
let rhs = pairing(&g1, &g2) * ab; // Gt scalar multiplication

assert_eq!(lhs, rhs);

// Negation: e(-G1, G2) == e(G1, -G2) == -e(G1, G2)
let neg_p = pairing(&-g1, &g2);
let neg_q = pairing(&g1, &-g2);
assert_eq!(neg_p, neg_q);
assert_eq!(neg_p, -pairing(&g1, &g2));
```

--------------------------------

### Gt Group Operations and Compression

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Demonstrates group operations (addition, scalar multiplication, negation) and torus-based compression for the Gt target group. Pairing results are always in the cyclotomic subgroup and are compressible.

```rust
use blstrs::{Gt, G1Affine, G2Affine, Scalar, pairing};
use group::Group;
use traits::Compress; // blstrs::Compress
use blstrs::Compress;
use rand_core::OsRng;

// Gt from pairing
let p = G1Affine::generator();
let q = G2Affine::generator();
let gt = pairing(&p, &q);

// Group operations (written additively; semantically multiplicative in Fq12)
let doubled = gt.double();       // gt * gt in Fq12
let sum = gt + gt;               // also gt * gt
assert_eq!(doubled, sum);

// Scalar multiplication
let s = Scalar::from(4u64);
let scaled = gt * s;
assert_eq!(scaled, gt + gt + gt + gt);

// Negation (unitary conjugate)
let neg = -gt;
assert_eq!(gt + neg, Gt::identity());

// Torus-based compression (cyclotomic subgroup elements only)
// Pairing results are always in the cyclotomic subgroup
let compressed = gt.compress().expect("pairing result is compressible");
let decompressed = compressed.uncompress().expect("valid compressed point");
assert_eq!(gt, decompressed);

// Write/read compressed form via Compress trait
let mut buf: Vec<u8> = Vec::new();
gt.write_compressed(&mut buf).unwrap();
let restored = Gt::read_compressed(std::io::Cursor::new(buf)).unwrap();
assert_eq!(gt, restored);

// Verify pairing result is in the prime-order subgroup
assert!(bool::from(!gt.is_identity()));
```

--------------------------------

### Bilinear Pairing (`pairing`, `Bls12::pairing`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Computes the optimal Ate pairing `e: G1 × G2 → Gt`, a bilinear map satisfying `e(aP, bQ) = e(P, Q)^(ab)`. Supports direct function call and `Engine` trait implementation.

```APIDOC
## Bilinear Pairing (`pairing`, `Bls12::pairing`)

Computes the optimal Ate pairing `e: G1 × G2 → Gt`, a bilinear map satisfying `e(aP, bQ) = e(P, Q)^(ab)`. Two interfaces are available: the standalone `pairing()` function and the `Engine` trait implementation on `Bls12`.

### Functions

- `pairing(g1: &G1Affine, g2: &G2Affine) -> Gt`: Computes the bilinear pairing directly.
- `Bls12::pairing(g1: &G1Affine, g2: &G2Affine) -> Gt`: Computes the bilinear pairing using the `Engine` trait implementation.

### Properties

- Bilinearity: `e(aP, bQ) = e(P, Q)^(a*b)`
- Negation: `e(-G1, G2) = e(G1, -G2) = -e(G1, G2)`
```

--------------------------------

### G1 Group Projective Coordinates Operations

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Demonstrates basic group operations, conversion to affine coordinates, and scalar multiplication for G1 elements in projective coordinates. Supports multi-scalar multiplication (MSM) via Pippenger's algorithm.

```rust
use blstrs::{G1Projective, G1Affine, Scalar};
use group::{Group, Curve};
use rand_core::OsRng;

// Generator, identity, and random point
let g = G1Projective::generator();
let id = G1Projective::identity();
let r = G1Projective::random(OsRng);

// Group operations
let doubled = g.double();
let sum = g + r;
let diff = g - r;
let neg = -g;
assert_eq!(g + neg, G1Projective::identity());

// Convert to affine for storage
let affine: G1Affine = g.to_affine();
let back: G1Projective = G1Projective::from(affine);

// Scalar multiplication
let s = Scalar::from(7u64);
let p = g * s;
assert_eq!(p, g + g + g + g + g + g + g); // 7*G

// Multi-scalar multiplication (Pippenger's algorithm)
let points: Vec<G1Projective> = (0..10).map(|_| G1Projective::random(OsRng)).collect();
let scalars: Vec<Scalar> = (0..10).map(|_| Scalar::random(OsRng)).collect();

// Naive reference
let naive: G1Projective = points.iter().zip(scalars.iter())
    .map(|(p, s)| p * s)
    .fold(G1Projective::identity(), |acc, x| acc + x);

// Optimized MSM
let msm = G1Projective::multi_exp(&points, &scalars);
assert_eq!(naive, msm);
```

--------------------------------

### Scalar Field Operations (Scalar)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Demonstrates scalar field arithmetic, serialization, inversion, square root, and random scalar generation. Requires the `ff` and `rand_core` crates.

```rust
use blstrs::Scalar;
use ff::{Field, PrimeField};
use rand_core::OsRng;

// Construct scalars
let a = Scalar::from(42u64);
let b = Scalar::from_bytes_le(&[
    1, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0,
]).unwrap(); // Scalar::ONE

// Arithmetic (all operations are mod r)
let sum = a + b;
let product = a * b;
let diff = a - b;
let neg_a = -a;

// Inversion (returns CtOption)
let inv = a.invert().unwrap(); // panics if a == 0
assert_eq!(a * inv, Scalar::ONE);

// Square root (returns CtOption)
let sq = a.square();
let root = sq.sqrt().unwrap();
assert!(root == a || root == -a);

// Serialization: little-endian and big-endian bytes
let le_bytes: [u8; 32] = a.to_bytes_le();
let be_bytes: [u8; 32] = a.to_bytes_be();
let roundtrip = Scalar::from_bytes_be(&be_bytes).unwrap();
assert_eq!(a, roundtrip);

// From u64 array (little-endian non-Montgomery form)
let c = Scalar::from_u64s_le(&[9999, 9999, 0, 0]).unwrap();

// Shift operations
let shifted = c.shl(3);  // c << 3
let rshifted = c.shr(1); // c >> 1
let tripled = c.mul3();  // c * 3

// Random scalar
let r = Scalar::random(OsRng);

// Exponentiation via ff trait
let exp = r.pow_vartime([2u64, 0, 0, 0]); // r^2
assert_eq!(exp, r.square());

// Bit representation
use ff::PrimeFieldBits;
let bits: Vec<bool> = Scalar::ONE.to_le_bits().into_iter().collect();
assert!(bits[0]); // LSB is 1

```

--------------------------------

### G1 Group Affine Coordinates (G1Affine)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Shows how to use G1Affine for compressed/uncompressed serialization, scalar multiplication, and curve validity checks. Requires `group` and `ff` crates.

```rust
use blstrs::{G1Affine, G1Projective, Scalar};
use group::{Group, Curve, GroupEncoding};
use ff::Field;
use rand_core::OsRng;

// Generator and identity
let g = G1Affine::generator();
let id = G1Affine::identity();
assert!(bool::from(id.is_identity()));
assert!(!bool::from(g.is_identity()));

// Compressed serialization (48 bytes)
let compressed: [u8; 48] = g.to_compressed();
let g_back = G1Affine::from_compressed(&compressed).unwrap();
assert_eq!(g, g_back);

// Uncompressed serialization (96 bytes)
let uncompressed: [u8; 96] = g.to_uncompressed();
let g_back2 = G1Affine::from_uncompressed(&uncompressed).unwrap();
assert_eq!(g, g_back2);

// GroupEncoding trait (also 48-byte compressed)
let repr = g.to_bytes();
let g_back3 = G1Affine::from_bytes(&repr).unwrap();
assert_eq!(g, g_back3);

// Scalar multiplication (returns G1Projective)
let s = Scalar::from(5u64);
let p: G1Projective = g * s;
let p_affine = G1Affine::from(p);

// Curve validity
assert!(bool::from(g.is_on_curve()));
assert!(bool::from(g.is_torsion_free()));

// Raw I/O (prefixed with 0x00/0x01 infinity flag)
let mut buf = Vec::new();
g.write_raw(&mut buf).unwrap();
let g_from_raw = G1Affine::read_raw(std::io::Cursor::new(&buf)).unwrap();
assert_eq!(g, g_from_raw);

// Hash to G1 curve
let msg = b"hello world";
let dst = b"BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_";
let aug = b"";
let p_hash = G1Projective::hash_to_curve(msg, dst, aug);
assert!(bool::from(G1Affine::from(p_hash).is_on_curve()));

```

--------------------------------

### Aggregate Pairing Verification (`PairingG1G2`, `PairingG2G1`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

High-level pairing context objects for aggregating and verifying BLS signatures. Supports message hashing, multiple `aggregate()` calls, `commit()`, optional `merge()`, and `finalverify()`.

```APIDOC
## Aggregate Pairing Verification (`PairingG1G2`, `PairingG2G1`)

High-level pairing context objects for aggregating and verifying BLS signatures. Support message hashing or encoding, multiple `aggregate()` calls, a `commit()` step, optional `merge()` of two contexts, and `finalverify()`.

### Usage
```rust
use blstrs::{PairingG1G2, G1Affine, G2Affine};
use blst::BLST_ERROR;

let pk: G1Affine = G1Affine::generator(); // public key in G1
let sig: G2Affine = G2Affine::generator(); // signature in G2
let msg = b"message to verify";
let dst = b"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_";
let aug = b"";

// Create pairing context (hash_or_encode = true means hash-to-curve)
let mut ctx = PairingG1G2::new(true, dst);

// Aggregate (pk, sig, msg) pair
match ctx.aggregate(&pk, Some(&sig), msg, aug) {
    Ok(()) => {}, 
    Err(e) => eprintln!("Aggregation error: {:?}", e),
}

// Finalize aggregation
ctx.commit();

// Final verification (None = no pre-aggregated GT signature)
let verified = ctx.finalverify(None);
println!("Signature verified: {}", verified);

// Merging two pairing contexts (for parallel verification)
let mut ctx2 = PairingG1G2::new(true, dst);
ctx2.aggregate(&pk, Some(&sig), b"other message", aug).unwrap();
ctx2.commit();
ctx.merge(&ctx2).expect("merge succeeded");
```
```

--------------------------------

### Compute Multi-Miller Loop Product

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Efficiently computes a product of Miller loop evaluations in a single pass, followed by a final exponentiation. This is more efficient than individual pairings.

```rust
use blstrs::{Bls12, G1Affine, G2Affine, G2Prepared, Scalar};
use pairing_lib::{Engine, MillerLoopResult, MultiMillerLoop};
use ff::Field;

let g1 = G1Affine::generator();
let g2 = G2Affine::generator();

// Prepare G2 points (precomputes Miller loop lines)
let a1 = G1Affine::from(G1Affine::generator() * Scalar::from(2u64));
let b1 = G2Prepared::from(G2Affine::generator());

let a2 = G1Affine::from(G1Affine::generator() * Scalar::from(3u64));
let b2 = G2Prepared::from(G2Affine::from(G2Affine::generator() * Scalar::from(5u64)));

// Multi-Miller loop then final exponentiation
let result = <Bls12 as MultiMillerLoop>::multi_miller_loop(&[
    (&a1, &b1),
    (&a2, &b2),
])
.final_exponentiation();

// Compare against individual pairings summed in Gt
let expected = Bls12::pairing(&a1, &G2Affine::from(G2Prepared::from(g2).clone()))
    + Bls12::pairing(&a2, &G2Affine::from(G2Prepared::from(
        G2Affine::from(G2Affine::generator() * Scalar::from(5u64))
    )));
// result == expected (multi_miller_loop is the optimized path)
```

--------------------------------

### Target Group (`Gt` and `GtCompressed`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Operations on the multiplicative target group `Gt`, which is a subgroup of `Fq¹²`. Supports group operations, scalar multiplication, and torus-based compression.

```APIDOC
## Target Group (`Gt` and `GtCompressed`)

The multiplicative target group `Gt` is a subgroup of `Fq¹²` of order `r`. Written additively in this library, with `+` corresponding to `Fq¹²` multiplication. Supports group operations, scalar multiplication, and torus-based compression to half the size (288 bytes compressed vs. 576 bytes uncompressed).

### Usage
```rust
use blstrs::{Gt, G1Affine, G2Affine, Scalar, pairing};
use group::Group;
use traits::Compress; // blstrs::Compress
use blstrs::Compress;
use rand_core::OsRng;

// Gt from pairing
let p = G1Affine::generator();
let q = G2Affine::generator();
let gt = pairing(&p, &q);

// Group operations (written additively; semantically multiplicative in Fq12)
let doubled = gt.double();       // gt * gt in Fq12
let sum = gt + gt;               // also gt * gt
assert_eq!(doubled, sum);

// Scalar multiplication
let s = Scalar::from(4u64);
let scaled = gt * s;
assert_eq!(scaled, gt + gt + gt + gt);

// Negation (unitary conjugate)
let neg = -gt;
assert_eq!(gt + neg, Gt::identity());

// Torus-based compression (cyclotomic subgroup elements only)
// Pairing results are always in the cyclotomic subgroup
let compressed = gt.compress().expect("pairing result is compressible");
let decompressed = compressed.uncompress().expect("valid compressed point");
assert_eq!(gt, decompressed);

// Write/read compressed form via Compress trait
let mut buf: Vec<u8> = Vec::new();
gt.write_compressed(&mut buf).unwrap();
let restored = Gt::read_compressed(std::io::Cursor::new(buf)).unwrap();
assert_eq!(gt, restored);

// Verify pairing result is in the prime-order subgroup
assert!(bool::from(!gt.is_identity()));
```
```

--------------------------------

### Multi-Miller Loop (`Bls12::multi_miller_loop`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Computes a product of Miller loop evaluations in a single pass, followed by a final exponentiation. This method is more efficient than computing individual pairings and multiplying them.

```APIDOC
## Multi-Miller Loop (`Bls12::multi_miller_loop`)

Computes a product of Miller loop evaluations `∑ ML(aᵢ, bᵢ)` in a single pass, followed by a final exponentiation. This is significantly more efficient than computing individual pairings and multiplying them together in `Gt`.

### Usage
```rust
use blstrs::{Bls12, G1Affine, G2Affine, G2Prepared, Scalar};
use pairing_lib::{Engine, MillerLoopResult, MultiMillerLoop};
use ff::Field;

let g1 = G1Affine::generator();
let g2 = G2Affine::generator();

// Prepare G2 points (precomputes Miller loop lines)
let a1 = G1Affine::from(G1Affine::generator() * Scalar::from(2u64));
let b1 = G2Prepared::from(G2Affine::generator());

let a2 = G1Affine::from(G1Affine::generator() * Scalar::from(3u64));
let b2 = G2Prepared::from(G2Affine::from(G2Affine::generator() * Scalar::from(5u64)));

// Multi-Miller loop then final exponentiation
let result = <Bls12 as MultiMillerLoop>::multi_miller_loop(&[
    (&a1, &b1),
    (&a2, &b2),
])
.final_exponentiation();

// Compare against individual pairings summed in Gt
let expected = Bls12::pairing(&a1, &G2Affine::from(G2Prepared::from(g2).clone()))
    + Bls12::pairing(&a2, &G2Affine::from(G2Prepared::from(
        G2Affine::from(G2Affine::generator() * Scalar::from(5u64))
    )));
// result == expected (multi_miller_loop is the optimized path)
```
```

--------------------------------

### Scalar Field Operations

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Demonstrates the construction and arithmetic operations for Scalar elements in the BLS12-381 scalar field.

```APIDOC
## Scalar Field (`Scalar`)

Represents an element of the BLS12-381 scalar field `Fr` with modulus `r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001`. Internally stored in Montgomery form. Implements `ff::Field`, `ff::PrimeField`, and `ff::PrimeFieldBits`, supporting arithmetic operations, serialization, square roots, and inversion.

```rust
use blstrs::Scalar;
use ff::{Field, PrimeField};
use rand_core::OsRng;

// Construct scalars
let a = Scalar::from(42u64);
let b = Scalar::from_bytes_le(&[
    1, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0,
]).unwrap(); // Scalar::ONE

// Arithmetic (all operations are mod r)
let sum = a + b;
let product = a * b;
let diff = a - b;
let neg_a = -a;

// Inversion (returns CtOption)
let inv = a.invert().unwrap(); // panics if a == 0
assert_eq!(a * inv, Scalar::ONE);

// Square root (returns CtOption)
let sq = a.square();
let root = sq.sqrt().unwrap();
assert!(root == a || root == -a);

// Serialization: little-endian and big-endian bytes
let le_bytes: [u8; 32] = a.to_bytes_le();
let be_bytes: [u8; 32] = a.to_bytes_be();
let roundtrip = Scalar::from_bytes_be(&be_bytes).unwrap();
assert_eq!(a, roundtrip);

// From u64 array (little-endian non-Montgomery form)
let c = Scalar::from_u64s_le(&[9999, 9999, 0, 0]).unwrap();

// Shift operations
let shifted = c.shl(3);  // c << 3
let rshifted = c.shr(1); // c >> 1
let tripled = c.mul3();  // c * 3

// Random scalar
let r = Scalar::random(OsRng);

// Exponentiation via ff trait
let exp = r.pow_vartime([2u64, 0, 0, 0]); // r^2
assert_eq!(exp, r.square());

// Bit representation
use ff::PrimeFieldBits;
let bits: Vec<bool> = Scalar::ONE.to_le_bits().into_iter().collect();
assert!(bits[0]); // LSB is 1
```
```

--------------------------------

### G2 Group Affine and Projective Coordinates Operations

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Covers operations for G2 group elements in both affine and projective coordinates. Includes compressed and uncompressed serialization, scalar multiplication, precomputation for pairings, and curve validity checks.

```rust
use blstrs::{G2Affine, G2Projective, G2Prepared, Scalar};
use group::{Group, Curve, GroupEncoding};
use rand_core::OsRng;

// Generator and identity
let g2 = G2Affine::generator();
let id2 = G2Affine::identity();

// Compressed serialization (96 bytes)
let compressed: [u8; 96] = g2.to_compressed();
let g2_back = G2Affine::from_compressed(&compressed).unwrap();
assert_eq!(g2, g2_back);

// Uncompressed serialization (192 bytes)
let uncompressed: [u8; 192] = g2.to_uncompressed();
let g2_back2 = G2Affine::from_uncompressed(&uncompressed).unwrap();
assert_eq!(g2, g2_back2);

// Scalar multiplication
let s = Scalar::from(3u64);
let p2: G2Projective = G2Projective::generator() * s;

// Precompute for repeated pairing use (Miller loop line precomputation)
let g2_prepared = G2Prepared::from(g2);

// Curve validity
assert!(bool::from(g2.is_on_curve()));
assert!(bool::from(g2.is_torsion_free()));

// Group arithmetic (projective)
let a = G2Projective::random(OsRng);
let b = G2Projective::random(OsRng);
let c = a + b;
let d = a.double();
assert!(bool::from(G2Affine::from(c).is_on_curve()));
assert!(bool::from(G2Affine::from(d).is_on_curve()));
```

--------------------------------

### Aggregate BLS Signature Verification

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Shows how to use PairingG1G2 context for aggregating and verifying BLS signatures. Supports message hashing, multiple aggregations, merging contexts, and final verification.

```rust
use blstrs::{PairingG1G2, G1Affine, G2Affine};
use blst::BLST_ERROR;

let pk: G1Affine = G1Affine::generator(); // public key in G1
let sig: G2Affine = G2Affine::generator(); // signature in G2
let msg = b"message to verify";
let dst = b"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_";
let aug = b"";

// Create pairing context (hash_or_encode = true means hash-to-curve)
let mut ctx = PairingG1G2::new(true, dst);

// Aggregate (pk, sig, msg) pair
match ctx.aggregate(&pk, Some(&sig), msg, aug) {
    Ok(()) => {}, 
    Err(e) => eprintln!("Aggregation error: {:?}", e),
}

// Finalize aggregation
ctx.commit();

// Final verification (None = no pre-aggregated GT signature)
let verified = ctx.finalverify(None);
println!("Signature verified: {}", verified);

// Merging two pairing contexts (for parallel verification)
let mut ctx2 = PairingG1G2::new(true, dst);
ctx2.aggregate(&pk, Some(&sig), b"other message", aug).unwrap();
ctx2.commit();
ctx.merge(&ctx2).expect("merge succeeded");
```

--------------------------------

### G1 Group — Projective (`G1Projective`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Operations on G1 elements in projective coordinates, including group arithmetic, conversions, and multi-scalar multiplication.

```APIDOC
## G1 Group — Projective (`G1Projective`)

An element of `G1` in projective (Jacobian) coordinates, used for efficient group arithmetic. Convertible to/from `G1Affine`. Supports multi-scalar multiplication (MSM) via Pippenger's algorithm.

### Methods

- `generator()`: Returns the generator of the G1 group.
- `identity()`: Returns the identity element of the G1 group.
- `random(OsRng)`: Returns a random element of the G1 group.
- `double()`: Doubles the current G1 element.
- `to_affine()`: Converts the G1 projective element to affine coordinates.
- `from(G1Affine)`: Converts an affine G1 element to projective coordinates.
- `multi_exp(points: Vec<G1Projective>, scalars: Vec<Scalar>)`: Computes the multi-scalar multiplication of points and scalars using Pippenger's algorithm.

### Operators

- `+`: Adds two G1 elements.
- `-`: Negates a G1 element.
- `*`: Multiplies a G1 element by a scalar.
```

--------------------------------

### G2 Group — Affine and Projective (`G2Affine`, `G2Projective`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Operations on G2 elements in affine and projective coordinates, including serialization, scalar multiplication, and curve validity checks.

```APIDOC
## G2 Group — Affine and Projective (`G2Affine`, `G2Projective`)

Elements of the `G2` group defined over the quadratic extension field `Fq²`. `G2Affine` uses compressed (96-byte) and uncompressed (192-byte) forms; `G2Projective` is used for efficient arithmetic. The `G2Prepared` type precomputes Miller loop lines for faster pairing evaluation.

### Methods

- `generator()`: Returns the generator of the G2 group.
- `identity()`: Returns the identity element of the G2 group.
- `to_compressed()`: Serializes the G2 affine element to a compressed 96-byte format.
- `from_compressed([u8; 96])`: Deserializes a G2 affine element from compressed format.
- `to_uncompressed()`: Serializes the G2 affine element to an uncompressed 192-byte format.
- `from_uncompressed([u8; 192])`: Deserializes a G2 affine element from uncompressed format.
- `random(OsRng)`: Returns a random G2 projective element.
- `from(G2Affine)`: Converts an affine G2 element to projective coordinates.
- `is_on_curve()`: Checks if the G2 element is on the curve.
- `is_torsion_free()`: Checks if the G2 element is torsion-free.

### Operators

- `+`: Adds two G2 projective elements.
- `*`: Multiplies a G2 projective element by a scalar.
```

--------------------------------

### Unique Message Check (`unique_messages`)

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Efficiently checks if a slice of byte messages are all distinct using `blst`'s hash-based deduplication.

```APIDOC
## Unique Message Check (`unique_messages`)

Efficiently checks whether a slice of byte messages are all distinct. Uses `blst`'s `blst_uniq` hash-based deduplication for large slices, with shortcut paths for 1 or 2 messages.

### Usage
```rust
use blstrs::unique_messages;

let msgs: Vec<&[u8]> = vec![b"alpha", b"beta", b"gamma"];
assert!(unique_messages(&msgs));

let dup_msgs: Vec<&[u8]> = vec![b"alpha", b"beta", b"alpha"];
assert!(!unique_messages(&dup_msgs));

let single: Vec<&[u8]> = vec![b"only one"];
assert!(unique_messages(&single)); // single message is always unique
```
```

--------------------------------

### Check for Unique Messages

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Efficiently checks if all byte messages in a slice are distinct. Uses blst's hash-based deduplication for large slices and provides shortcut paths for small slices.

```rust
use blstrs::unique_messages;

let msgs: Vec<&[u8]> = vec![b"alpha", b"beta", b"gamma"];
assert!(unique_messages(&msgs));

let dup_msgs: Vec<&[u8]> = vec![b"alpha", b"beta", b"alpha"];
assert!(!unique_messages(&dup_msgs));

let single: Vec<&[u8]> = vec![b"only one"];
assert!(unique_messages(&single)); // single message is always unique
```

--------------------------------

### G1 Group — Affine Coordinates

Source: https://context7.com/filecoin-project/blstrs/llms.txt

Operations for G1 group elements represented in affine coordinates, including serialization, scalar multiplication, and hashing.

```APIDOC
## G1 Group — Affine (`G1Affine`)

An element of `G1` stored in affine coordinates `(x, y)` over `Fq`. Affine representation is memory-efficient and preferred for storage. Supports compressed (48-byte) and uncompressed (96-byte) serialization, scalar multiplication, and curve validity checks.

```rust
use blstrs::{G1Affine, G1Projective, Scalar};
use group::{Group, Curve, GroupEncoding};
use ff::Field;
use rand_core::OsRng;

// Generator and identity
let g = G1Affine::generator();
let id = G1Affine::identity();
assert!(bool::from(id.is_identity()));
assert!(!bool::from(g.is_identity()));

// Compressed serialization (48 bytes)
let compressed: [u8; 48] = g.to_compressed();
let g_back = G1Affine::from_compressed(&compressed).unwrap();
assert_eq!(g, g_back);

// Uncompressed serialization (96 bytes)
let uncompressed: [u8; 96] = g.to_uncompressed();
let g_back2 = G1Affine::from_uncompressed(&uncompressed).unwrap();
assert_eq!(g, g_back2);

// GroupEncoding trait (also 48-byte compressed)
let repr = g.to_bytes();
let g_back3 = G1Affine::from_bytes(&repr).unwrap();
assert_eq!(g, g_back3);

// Scalar multiplication (returns G1Projective)
let s = Scalar::from(5u64);
let p: G1Projective = g * s;
let p_affine = G1Affine::from(p);

// Curve validity
assert!(bool::from(g.is_on_curve()));
assert!(bool::from(g.is_torsion_free()));

// Raw I/O (prefixed with 0x00/0x01 infinity flag)
let mut buf = Vec::new();
g.write_raw(&mut buf).unwrap();
let g_from_raw = G1Affine::read_raw(std::io::Cursor::new(&buf)).unwrap();
assert_eq!(g, g_from_raw);

// Hash to G1 curve
let msg = b"hello world";
let dst = b"BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_";
let aug = b"";
let p_hash = G1Projective::hash_to_curve(msg, dst, aug);
assert!(bool::from(G1Affine::from(p_hash).is_on_curve()));
```
```

--------------------------------

### BLS12-381 G1 Generator Coordinates

Source: https://github.com/filecoin-project/blstrs/blob/master/README.md

The lexicographically smallest x and y coordinates for the G1 generator of the BLS12-381 curve.

```plaintext
x = 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
y = 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
```

--------------------------------

### G2 Elliptic Curve Point Representation

Source: https://github.com/filecoin-project/blstrs/blob/master/README.md

Defines the representation of a point on the G2 elliptic curve using large integer arithmetic. This is typically used in cryptographic operations.

```plaintext
x = 3059144344244213709971259814753781636986470325476647558659373206291635324768958432433509563104347017837885763365758*u + 352701069587466618187139116011060144890029952792775240219908644239793785735715026873347600343865175952761926303160
y = 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582*u + 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.