BLS digital signature

The scheme uses a bilinear pairing $e : G_{1} \times G_{2} \to G_{T}$ , where $G_{1}, G_{2},$ and $G_{T}$ are elliptic curve groups of prime order $q$ , and a hash function $H$ from the message space into $G_{1}$ . Signature are elements of $G_{1}$ , public keys are elements of $G_{2}$ , and the secret key is an integer in $[0, q - 1]$ . Working in an elliptic curve group provides some defense against index calculus attacks (with the caveat that such attacks are still possible in the target group $G_{T}$ of the pairing), allowing shorter signatures than FDH signatures for a similar level of security.

Signatures produced by the BLS signature scheme are often referred to as short signatures, BLS short signatures, or simply BLS signatures. The signature scheme is provably secure (the scheme is existentially unforgeable under adaptive chosen-message attacks) in the random oracle model assuming the intractability of the computational Diffie–Hellman problem in a gap Diffie–Hellman group.

BLS signature scheme

A signature scheme consists of three functions: generate, sign, and verify.

Key generation

The key generation algorithm selects the private key by picking a random integer $x \in [0, q - 1]$ . The holder of the private key publishes the public key, $g_{2}^{x}$ , where $g_{2}$ is a generator of $G_{2}$ .

Signing

Given the private key $x$ , and some message $m$ , we compute the signature by hashing the bitstring $m$ , as $h = H (m)$ , and we output the signature $σ = h^{x}$ .

Verification

Given a signature $σ$ for message $m$ and public key $g_{2}^{x}$ , we verify that $e (σ, g_{2}) = e (H (m), g_{2}^{x})$ .

3 more chapters are free with a Lably account.

BLS digital signature

BLS signature scheme

Properties

Curves

BLS12-381

Implementations

More in Computing and communication