Add G1 and G2 point value check

py_ecc/bls/point_compression.py

@@ -99,6 +99,8 @@ def decompress_G1(z: G1Compressed) -> G1Uncompressed:
     # Else, not point at infinity
     # 3 MSBs should be 100 or 101
     x = z % POW_2_381
+    if x >= q:
+        raise ValueError("Point value should be less than field modulus. Got %d", x)
 
     # Try solving y coordinate from the equation Y^2 = X^3 + b
     # using quadratic residue
@@ -195,10 +197,9 @@ def decompress_G2(p: G2Compressed) -> G2Uncompressed:
     # 3 MSBs should be 100 or 101
     x1 = z1 % POW_2_381
 
-    # Validate z2 flags
-    c_flag2, b_flag2, a_flag2 = get_flags(z2)
-    if not (c_flag2 is b_flag2 and b_flag2 is a_flag2 and a_flag2 is False):
-        raise ValueError("a_flag2, b_flag2, and c_flag2 should always set to 0")
+    # Ensure that z2 is less than the field modulus.
+    if z2 >= q:
+        raise ValueError("z2 point value should be less than field modulus. Got %d", z2)
 
     x2 = z2
     # x1 is the imaginary part, x2 is the real part

tests/bls/test_point_compression.py

@@ -78,6 +78,7 @@ def test_G1_compress_and_decompress_flags(pt, on_curve, is_infinity):
         (compressed_g1 | (1<<382), "b_flag should be 0"),  # set b_flag to 1
         (compressed_z1 & ~(1<<382), "b_flag should be 1"),  # set b_flag to 0
         (compressed_z1 | (1<<381), "a point at infinity should have a_flag == 0"),  # set a_flag to 1
+        (q | (1<<383), "Point value should be less than field modulus."),  # field modulus and c_flag
     ]
 )
 def test_decompress_G1_edge_case(z, error_message):
@@ -143,9 +144,10 @@ def test_G2_compress_and_decompress_flags(pt, on_curve, is_infinity):
         ((compressed_g2[0] | (1<<382), compressed_g2[1]), "b_flag should be 0"),  # set b_flag1 to 1
         ((compressed_z2[0] & ~(1<<382), compressed_z2[1]), "b_flag should be 1"),  # set b_flag1 to 0
         ((compressed_z2[0] | (1<<381), compressed_z2[1]), "a point at infinity should have a_flag == 0"),  # set a_flag1 to 1
-        ((compressed_g2[0], compressed_z2[1] | (1<<383)), "a_flag2, b_flag2, and c_flag2 should always set to 0"),  # set c_flag2 to 1
-        ((compressed_g2[0], compressed_z2[1] | (1<<382)), "a_flag2, b_flag2, and c_flag2 should always set to 0"),  # set b_flag2 to 1
-        ((compressed_g2[0], compressed_z2[1] | (1<<381)), "a_flag2, b_flag2, and c_flag2 should always set to 0"),  # set a_flag2 to 1
+        ((compressed_g2[0], compressed_z2[1] | (1<<383)), "z2 point value should be less than field modulus."),  # set c_flag2 to 1
+        ((compressed_g2[0], compressed_z2[1] | (1<<382)), "z2 point value should be less than field modulus."),  # set b_flag2 to 1
+        ((compressed_g2[0], compressed_z2[1] | (1<<381)), "z2 point value should be less than field modulus."),  # set a_flag2 to 1
+        ((compressed_g2[0], compressed_g2[1] + q), "z2 point value should be less than field modulus."),  # z2 value >= field modulus
     ]
 )
 def test_decompress_G2_edge_case(z, error_message):