BLS Signatures

Every time you send a signed message — a bank transfer, a vote, a blockchain transaction — the recipient must verify a signature. In most systems, if 1,000 people sign 1,000 different messages, the verifier must check 1,000 separate signatures. That cost is linear: twice the signers, twice the work.

BLS signatures (Boneh–Lynn–Shacham, 2001) break that rule. Using a piece of mathematics called an elliptic-curve pairing, you can aggregate any number of signatures — possibly from thousands of different public keys, signing different messages — into a single constant-size signature. The verifier checks one pairing equation and is done.

The saving is not just a constant factor. In systems like Ethereum's consensus layer, where hundreds of thousands of validators must collectively sign every block, the difference between "one signature per validator" and "one aggregate signature per block" is the difference between grinding to a halt and running in real time.

This article walks you through the intuition: what a pairing is, why aggregation works, and why the security rests on a hardness assumption related to the discrete logarithm problem on elliptic curves.

The demo below simulates the BLS aggregation workflow using small integers — real BLS lives on 256-bit elliptic curves, but the structure is identical. Each signer has a private key and a public key. Clicking Sign produces that signer's signature. Aggregate folds all signatures into one combined value. Verify checks the aggregate against all public keys at once.

<p class="hint">
  {{hint}}
</p>
<div id="signers-grid"></div>
<div class="agg-row">
  <button id="btn-agg" type="button">{{btn_aggregate}}</button>
  <div id="agg-box" class="agg-box">{{agg_label}} <span id="agg-val">—</span></div>
</div>
<div class="verify-row">
  <button id="btn-verify" type="button">{{btn_verify}}</button>
  <div id="verify-status" class="status">{{status_default}}</div>
</div>
<p class="footnote">{{footnote}}</p>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; font-size: 14px; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .8rem; line-height: 1.5; }
.footnote { font-size: .78rem; color: #777; margin-top: .8rem; line-height: 1.45; }
#signers-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 8px; margin-bottom: 10px; }
.signer-card { border: 1px solid #cdd9e3; border-radius: 10px; padding: 10px 12px; background: #f5f8fb; }
.signer-card h4 { margin: 0 0 6px; font-size: .9rem; color: #1d3557; }
.kv { display: flex; justify-content: space-between; font-size: .82rem; margin: 2px 0; color: #444; }
.kv .val { font-family: ui-monospace, monospace; color: #1d3557; font-weight: 600; }
.sig-row { display: flex; align-items: center; gap: 8px; margin-top: 8px; }
.sig-row .val { font-family: ui-monospace, monospace; font-weight: 600; color: #0a7d33; min-width: 36px; }
.sig-row .val.empty { color: #aaa; }
button { font: 600 13px system-ui, sans-serif; padding: .4rem .85rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; white-space: nowrap; }
button.ghost { background: #fff; color: #1d3557; }
button.signed { background: #0a7d33; border-color: #0a7d33; }
.agg-row { display: flex; align-items: center; gap: 10px; margin: 6px 0; flex-wrap: wrap; }
.agg-box { font-size: .9rem; color: #444; }
.agg-box span { font-family: ui-monospace, monospace; font-weight: 700; color: #e63946; }
.agg-box span.set { color: #1d3557; }
.verify-row { display: flex; align-items: center; gap: 10px; margin-top: 6px; flex-wrap: wrap; }
.status { font-size: .95rem; font-weight: 600; min-height: 1.4em; }
.status.ok { color: #0a7d33; }
.status.bad { color: #c92f3c; }
.status.warn { color: #b45309; }

// Code not found

Notice that after aggregation you have exactly one number regardless of how many signers contributed. Verification still confirms every individual message was signed by the correct key — that is the pairing magic at work. Click individual Sign buttons, then aggregate, then verify to see it succeed. Try verifying before all signers have signed to see it fail.

What makes BLS tick — and what keeps it honest?

The pairing $e(P, Q)$. A bilinear pairing takes two points on elliptic curves and returns a value in a finite field. "Bilinear" means: $e(aP, bQ) = e(P, Q)^{ab}$. This one identity is the entire engine of BLS.

• Key generation: each signer picks a random private key sk and computes the public key pk = sk · G, where G is a fixed curve base point — a standard elliptic-curve scalar multiplication.
• Signing: to sign message m, the signer hashes m to a curve point H(m) and computes the signature $\sigma = sk \cdot H(m)$. This is also just scalar multiplication.
• Aggregation: add all individual signatures as curve points —

  $$\sigma_{\mathrm{agg}} = \sigma_1 + \sigma_2 + \cdots + \sigma_n.$$

  Addition on an elliptic curve is fast and constant-cost per signer.
• Verification: check that

  $$e(\sigma_{\mathrm{agg}},\, G) = e(H(m_1), pk_1) \cdot e(H(m_2), pk_2) \cdots e(H(m_n), pk_n).$$

  Each pairing evaluation is the expensive step, but there are only n of them instead of n full verifications.

Security. The scheme is proven secure in the random oracle model under the co-Computational Diffie–Hellman (co-CDH) assumption: given $G$, $aG$ and $H(m)$, it is hard to compute $a \cdot H(m)$ without knowing a — a close cousin of the discrete logarithm problem. Breaking BLS would break co-CDH on the underlying curve (e.g. BLS12-381, the curve used by Ethereum).

The rogue-key attack. Naïve aggregation of public keys is vulnerable: a malicious signer can announce a "public key" that cancels out honest signers' contributions, forging a valid aggregate. The fix — requiring each signer to prove they hold the private key via a Proof of Possession — is mandatory in production. Ethereum's deposit contract enforces this.

Aggregation across messages vs a single message. Aggregating n signatures on n different messages requires n pairing evaluations on the verifier side. Aggregating n signatures on the same message reduces verification to just two pairings total — a massive further saving used in threshold and multi-signature settings.

Wherever a crowd must speak with one voice and bandwidth is precious, BLS signatures show up:

• Ethereum's consensus layer (beacon chain): roughly 500,000 validators each attest to the canonical chain every 12 seconds. Without aggregation the network would need to broadcast and process ~500,000 individual signatures per slot. With BLS aggregation, each committee collapses to a single aggregate signature — the most visible deployment of BLS at scale.
• Byzantine Fault Tolerant (BFT) consensus: protocols like Tendermint and HotStuff use threshold BLS to let a committee of n nodes produce a single "quorum certificate" signature once ⌈2n/3⌉ signers agree, without any trusted dealer.
• Threshold and multi-signature wallets: a multi-sig where k of n keyholders must co-sign a transaction can present one aggregate BLS signature on-chain, paying a flat verification cost instead of k separate checks.
• Certificate transparency and audit logs: BLS lets many independent auditors co-sign a batch of log entries; the single aggregate is stored and verified cheaply.
• Post-quantum caution: BLS relies on elliptic-curve pairings, which quantum computers could break with Shor's algorithm (see Shor's algorithm). The field is actively researching lattice-based aggregatable signatures as replacements.

In all these cases the key property is the same: aggregation is provably sound — no amount of clever manipulation by a subset of signers can produce a valid aggregate that includes a message no honest key ever signed.

BLS signatures are a beautiful example of mathematics earning its keep in engineering. A single algebraic identity — $e(aP, bQ) = e(P, Q)^{ab}$ — makes it possible to collapse an arbitrarily large crowd of signatures into one compact proof that a verifier can check with a handful of pairing evaluations.

The scheme is provably secure, linearly efficient in aggregation, and already deployed at planetary scale: every Ethereum block carries aggregated BLS attestations from hundreds of thousands of validators. Understanding BLS means understanding how modern blockchains afford to be decentralized at all.

The open frontier is quantum resistance. If large-scale quantum computers arrive, the co-CDH assumption breaks, and the field will need aggregatable signatures built on harder problems — likely lattices. Until then, BLS remains the gold standard for signature aggregation, and the pairing trick at its heart is one of the most elegant ideas in modern cryptography.