BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such signatures in a smart contract, using the new precompiled contracts for pairing operations (pairing equality, scalar multiplication, and point addition) released with Byzantium.
Verification of a BGLS signature of $n$ signers is done through checking equality $$e(g_1, σ) == \prod_i^n e(v_i, h_i)$$ where:
- $e : G_1 \times G_2 \rightarrow G_T$ is a bilinear pairing/mapping
- $g_1$ is a generator of $\mathbb{G}_1$
- $\sigma$ is the aggregate signature
- $v_i$ is the public key of signer $i$
- $h_i$ is the hash of the signed message of signer $i$
Question:
Does anyone know whether we can formulate the equality above in terms of only three operations: point additions, scalar multiplications, and equality checks?
Thoughts:
What I was thinking is that we could rewrite the equality as $$e(g_1, σ) == e(\prod_i^n v_i, \prod_i^n h_i)$$
but I have not been able to prove whether that is correct.
Background:
- Point additions, scalar multiplications, and equality checks are currently the only operations supported in Ethereum.
- I asked a similar, but more Solidity-specific, question on the Ethereum StackExchange.
- Another user posted a question on verifying BLS signatures (which is essentially a BGLS signature for one signer). My question can be seen as a follow-up on that.
