pbc-rs

Pairing-based cryptography suite in Rust, replacing the C PBC library.

A drop-in libpbc, and a strict modern API beside it.

CryptographyLibraryRust, C ABIv0.1.0, Apache-2.0

$ cargo add pbc-rs

Why

The PBC library is C, old, and still linked by programs that need pairings. pbc-rs replaces it in Rust, split into two profiles that are kept deliberately apart: a modern one that is small and strict, and a legacy one that reproduces PBC 1.0.0 closely enough to drop into existing binaries. Legacy compatibility is not a claim of modern security.

The README says it plainly: this is research software, LLM-assisted, with little to no review by a cryptographer and no audit. Don't use it in production.

The workspace

Crate	Role
`pbc-core`	Typed BLS12-381 scalars, groups, pairing, multi-pairing, RFC 9380 hashing. Not PBC-compatible.
`pbc-legacy`	Independent reimplementation of PBC's A, A1, D, E, F, G, I parameter families, codecs and hashes
`pbc-compat`	Checked PBC-style contexts over an explicitly chosen profile
`pbc-rs`	Facade re-exporting `pbc-compat`
`pbc-ffi`	Drop-in `libpbc.so.1` for C/C++ programs: 122 exports, PBC headers, links system GMP
`pbc-rs-ffi`	Modern C ABI `libpbc_rs`, BLS12-381 only

The pure Rust crates forbid unsafe; the two C ABI crates allow it, unreviewed. The default workspace build is modern-only. The legacy engine is tested against fixtures generated from the reference C build, and pbc-core has fuzz targets and dudect-style constant-time checks.

Modern API

Encodings are fixed-length and strictly validated, hashing always takes an explicit domain separation tag, and Debug output is redacted.

let e = pairing(&(G1::generator() * &a), &(G2::generator() * &b));
assert_eq!(e, pairing(&G1::generator(), &G2::generator()).pow(&(&a * &b)));

let dst = DomainSeparationTag::new(b"MYAPP-V01-CS01-with-BLS12381G1_XMD:SHA-256_SSWU_RO_")?;
let h = G1::hash_to_curve(b"input", dst);
assert!(G1::from_compressed(&h.to_compressed()[..47]).is_err());

Drop-in libpbc

For an existing program built against PBC (pinned target: Linux x86_64, glibc, GMP 6.3):

cargo build --release -p pbc-ffi
tools/install-libpbc.sh /opt/pbc-rs
LD_LIBRARY_PATH=/opt/pbc-rs/lib ./program-built-against-pbc

The script checks the SONAME and DT_NEEDED entries and never installs into a system location by default. Statically linked PBC programs must relink.