A BLS multi-signature combines signatures from multiple participants on the same message into one aggregate signature. Public keys are also combined, so verification checks the aggregate rather than verifying each signer separately. Key order and each participant’s index matter because public-key data is hashed during aggregation. section 18.1 section 18.2
The construction works over pairing groups: message hashes and individual signatures are points in G1, while public keys and the generator g2 are in G2. It uses H0 to hash a message to G1 and H1 to derive a scalar modulo r from a public key and the ordered public-key list. Each signer i computes s_i = a_i ψ_i H0(m), using its private key ψ_i and public-key-derived coefficient a_i. section 18.2 section 18.2.3
Aggregate and verify a shared-message signature as follows:
- Fix the ordered signer list, then hash each public key with that list to obtain its coefficient a_i. section 18.2 section 18.6.3
- Have every participant hash the identical message with H0 and create its individual G1 signature. section 18.2.3 section 18.3.4
- Send individual signatures to a combiner, which adds their curve points to form σ. section 18.2.3 section 18.3.4
- Compute or carry the aggregated public key A from the participating public keys, then compare e(σ, g2) with e(H0(m), A). section 18.2.3 section 18.3.4
Figure 18.2 Aggregated digital signature signing detailed schematic
Follow the signing flow from individual keys and signatures through aggregation to the single verification check. section 18.2
Simulated node workflow
A test setup creates 20 private/public key pairs, reads system parameters and a message, calculates public-key coefficients, signs once per node, sums the signatures, and verifies the resulting aggregate pairing equation. In a deployed arrangement, separate nodes must communicate their signatures to the chosen combiner. section 18.6.2 section 18.6.3 section 18.3.4
Implementation needs compatible G1 and G2 curve coefficients, generators of order tor, and validated field and extension-curve parameters. The implementation covers key creation, both hashes, coefficient and public-key aggregation, signing, signature aggregation, and pairing-based verification; communication between participants remains outside these routines. section 18.3 section 18.3.4
