High level BLS12-381 functions for Aiken

Introduction

Welcome to the BLS12-381 library for the Aiken smart-contract language! This library provides a comprehensive implementation of BLS12-381 signatures, enabling advanced cryptographic operations on the Cardano blockchain.

The library implements the three core BLS signature schemes as defined in the IETF BLS Signature draft:

• Basic (g1/basic): Standard BLS signatures
• Message Augmentation (g1/aug): Signatures with message augmentation for domain separation
• Proof of Possession (g1/pop): Signatures with PoP for rogue key attack resistance

Implementation Status

Currently, this library implements the Minimal-pubkey-size variant as defined in the IETF draft:

• Public keys: Points in G1 (48 bytes)
• Signatures: Points in G2 (96 bytes)

This approach is RECOMMENDED for implementations using signature aggregation, since the size of (PK_1, ..., PK_n, signature) is dominated by the public keys even for small n. By keeping public keys in G1 (the smaller group), we minimize the overall size of aggregated verification data.

API Note: The core cryptographic primitives are implemented in the g1/core module, while the public interfaces are exposed through the scheme-specific modules.

Implemented Functions

Core Module (g1/core)

Low-level cryptographic primitives used by all schemes:

Function	Description
key_gen	Generate secret key from random
sk_to_pk	Convert secret key to public key
key_validate	Validate a public key
core_sign	Core signing primitive
vore_verify	Core verification primitive
aggregate	Aggregate multiple signatures
core_aggregate_verify	Core aggregate verification

Basic Scheme (g1/basic)

Standard BLS signatures as specified in the IETF draft:

Function	Description
sk_to_pk	Convert secret key to public key
sign	Sign a message with private key
verify	Verify a signature with public key
aggregate	Combine multiple signatures
aggregate_verify	Verify aggregated signatures for distinct messages

Message Augmentation Scheme (g1/aug)

Signatures with message augmentation for domain separation:

Function	Description
sk_to_pk	Convert secret key to public key
sign	Sign a message with private key (augmented)
verify	Verify a signature with public key
aggregate	Combine multiple signatures
aggregate_verify	Verify aggregated signatures

Proof of Possession Scheme (g1/pop)

Signatures with PoP for rogue key attack resistance:

Function	Description
sk_to_pk	Convert secret key to public key
sign	Sign a message with private key
verify	Verify a signature with public key
pop_prove	Generate Proof-of-Possession signature for a public key
pop_verify	Verify a Proof-of-Possession signature
aggregate	Combine multiple signatures
aggregate_verify	Verify aggregated signatures

Getting Started

To get started with this library, make sure you have the Aiken environment set up and add this library to your aiken.toml:

[dependencies]
ilap/bls = { version = "x.y.z" }

Usage

Detailed usage examples and API documentation can be found in the lib/bls/tests and docs directory (generated with aiken docs). Here is a quick example to get you started:

use ilap/bls/g1/basic.{ sk_to_pk, sign, verify}

test test_bls () {
  let sk = #"ed69a93f0cf8c9836be3b67c7eeff416612d45ba39a5c099d48fa668bf558c9c"

  let pk = sk_to_pk(sk)
  let message = "Hello, Aiken!"

  let signature = sign(sk, message)

  verify(pk, message, signature)
}

BLS12-381 Technical Brief

• Embedding degree: 12 i.e. the complexity of the pairing operation.

• Field Size (𝑝): A large prime number defining the finite field i.e. 𝔽𝑝. The prime in the finite field is 381-bit.

• Prime Order (r): The number of points on the curve e.g. 𝑦^2=𝑥^3+4 for 𝑥∈{0,𝔽𝑝−1}. The number of points on the elliptic curve (excluding the point at infinity) is a prime number.

• Security level: BLS12-381 provides an approximate 128-bit security level, given that its complexity is around ≈√𝑟 i.e. 𝑟≈$2^{25}$6.

• Private key: A scalar in 𝔽𝑝 which means ∈{0,𝑝−1}. The size is 381 bits ~48 bytes.

• Identity Element: The multiplicative identity (1).

• Bilinear pairing : A function 𝑒:𝐺1×𝐺2→𝐺𝑇 with the following properties:

  • Non-degeneracy: 𝑒(𝑔1,𝑔2)≠1 for some 𝑔1∈𝐺1 and 𝑔2∈𝐺2.
  • Bilinearity: 𝑒(𝑎𝑔1,𝑏𝑔2)=𝑒(𝑔1,𝑔2)𝑎𝑏 for all 𝑎,𝑏∈𝔽𝑝 and 𝑔1∈𝐺1 and 𝑔2∈𝐺2.
  • Computability: There exists an efficient algorithm to compute 𝑒(𝑔1,𝑔2) for all 𝑔1∈𝐺1 and 𝑔2∈𝐺2.

• Group Definitions:

  • G1: This group consists of points on the elliptic curve over the base field 𝐹𝑝 (𝑦^2=𝑥^3+4).
  • G2:: This group consists of points on the twisted curve over an extension field 𝐹𝑝^2 (𝑦^2=𝑥^3+4(1+i)).
  • GT: This is the multiplicative group of a larger field 𝐹𝑝12, used as the result of the pairing operation.

Resources

• BLS Signatures Specification

Contributing

We welcome contributions to enhance the functionality and usabilioty of this library. Please refer to the CONTRIBUTING.md file for guidelines on how to contribute.

License

This project is licensed under the Apache 2.0 License - see the LICENSE file for details.