Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The combined short signature, along with the original messages and public keys, should convince the verifier that each message was signed by the owner of the public key.

What schemes support signature aggregation?
Please provide a scheme name and known implementation if such exists.

I am only aware of BLS signature implemented in PBC

| improve this question | | | | |
  • $\begingroup$ MuSig by Blockstream. $\endgroup$ – lovesh Jun 13 '18 at 17:10

I will have to read up on BLS, however, if I understand correctly by implementing the aggregation of $n$-messages, only the signature is aggregated - not the identities, so for an n-of-n multisig use-case it'll require knowing all public keys. I suspect you could make this tradeoff in both systems, but I will not spend the time to verify this conjecture.

The only other signature scheme that I know that supports aggregated signatures is Schnorr using Bellare and Neven. This supports n-of-n aggregated signatures and aggregated identities over a common message.

| improve this answer | | | | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.