BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such signatures in a smart contract, using the new precompiled contracts for pairing operations (pairing equality, scalar multiplication, and point addition) released with Byzantium.

Verification of a BGLS signature of $n$ signers is done through checking equality $$e(g_1, σ) == \prod_i^n e(v_i, h_i)$$ where:

  • $e : G_1 \times G_2 \rightarrow G_T$ is a bilinear pairing/mapping
  • $g_1$ is a generator of $\mathbb{G}_1$
  • $\sigma$ is the aggregate signature
  • $v_i$ is the public key of signer $i$
  • $h_i$ is the hash of the signed message of signer $i$

Does anyone know whether we can formulate the equality above in terms of only three operations: point additions, scalar multiplications, and equality checks?

What I was thinking is that we could rewrite the equality as $$e(g_1, σ) == e(\prod_i^n v_i, \prod_i^n h_i)$$ but I have not been able to prove whether that is correct.


  • Point additions, scalar multiplications, and equality checks are currently the only operations supported in Ethereum.
  • I asked a similar, but more Solidity-specific, question on the Ethereum StackExchange.
  • Another user posted a question on verifying BLS signatures (which is essentially a BGLS signature for one signer). My question can be seen as a follow-up on that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.