Signature verification checks whether an aggregate signature satisfies the pairing equation e(σ, g₂) = e(H₀(m), A). Recompute H₀(m) for every attempt so a changed message fails verification; mismatched messages likewise invalidate the aggregate. section 18.3.4
A practical multi-signature verification flow is:
- For subgroup signatures, hash the aggregate public key with the message and node indices, calculate three pairings, and compare w₁·w₂ with w₃. section 18.5
Verification output
A test signs the same 200-byte message with each node, aggregates the individual points, and calls multisig_verify(). Successful output reports that e(sigma, g2) matches e(H0, apk); verification can be performed by anyone holding the public keys, aggregate signature, and message. section 18.6.3
