BBS+ Signatures

Vasilis Kalos

What are BBS+??

Signature Algorithm

Message

Message

Regular Signatures

Regular Signatures

Signature Algorithm

Message

Message

Verification Algorithm

BBS+ Signature Algorithm

BBS+ Signatures

(Also, deterministic)

Constant size

(112 bytes for BLS12-381)

BBS+ Signatures

BBS+ Signature Algorithm

BBS+ Verification Algorithm

Proves:

• Integrity
• Authenticity
• Ownership

…of the signed message

s

BBS+ Signatures

BBS+ Signature Algorithm

BBS+ Verification Algorithm

BBS+ Proof Algorithm

BBS+ Proof Verification Algorithm

BBS+ Signatures

BBS+ Proof Algorithm

BBS+ Proof Verification Algorithm

Proves:

• Integrity
• Authenticity

…of the revealed messages

• Ownership

…of the whole list of signed messages

AND the signature

BBS+ Signatures

BBS+ Proof Algorithm

BBS+ Proof Verification Algorithm

Size linear to the number of hidden messages

(272 + no_hidden_msgs * 32 bytes for BLS12-381)

BBS+ Signatures

BBS+ Proof Algorithm

BBS+ Proof Verification Algorithm

Non-Interactive Zero-Knowledge proof

(NIZK)

• Un-likable presentations
• No information regarding the non-disclosed messages is leaked
• Proofs of knowledge

BBS+ Signatures Ecosystem

Issuer

Holder

Verifier

Message 1

Message 2

Message 3

Message L

Signature

BBS+ Signatures Ecosystem

Issuer

Holder

Verifier

Message 1

Message 2

Message 3

Message L

Signature

BBS+ Signatures Ecosystem

Issuer

Holder

Verifier

Message 1

Message L

BBS+ Blind Signatures

Issuer

Holder

Verifier

Commitment Proof

Blind the committed messages in a commitment

Proof that the commitment is correctly formed

BBS+ Blind Signatures

Issuer

Holder

Verifier

Commitment Proof

Check that the commitment is correctly formed

Commitment

BBS+ Blind Signatures

Issuer

Holder

Verifier

Known msg 1

Known msg 2

Known msg 2

Signature

BBS+ Blind Signatures

Issuer

Holder

Verifier

Known msg 1

Known msg 2

Known msg 2

Signature

Un-blind the commitment

Signature on all the messages

BBS+ Blind Signatures

Issuer

Holder

Verifier

Committed msg 1

Committed msg K

Known msg 1

Known msg 2

Known msg 2

Signature

BBS+ Blind Signatures

Issuer

Holder

Verifier

Committed msg K

Known msg 1

Why BBS+??

Part of an emerging pairing cryptography ecosystem

• Hash to curve
• BLS signatures
• Pairing friendly curves

​

Efficient, few-parameters.

• Keys and signature sizes similar to ECDSA
• Performance also close to ECDSA

​

Strong research line behind BBS+

• Multiple research papers have been published and reviewed over a long period of time

​

Easily extendable with reach features

• blind signatures
• group signatures
• range proofs

Pairings

Subgroup of an elliptic curve with prime order

A different subgroup of an elliptic curve with prime order

Subgroup of a large group with prime characteristic

Pairings

Pairings

Pairings

Exponents are multiplied out of the pairing

Pairings

You can switch them around

Pairings

Put them inside the paring in reverse order

Pairings

Encrypt/Sign with this!

Decrypt/Verify with this!

BBS+ Standardization

BBS+ Spec Scope

Core Spec

(BBS+ Core Signatures Spec)

Spec Extensions

(Blind BBS+ Signatures, etc.)

Cryptographic Specs

Representation Leyer

(VCs, JOSE, CBOR, JWP, etc.)

Interface (URDNA, JWP, …)

Protocol/Application Leyer

(Identity, Authn/Authz, IoT, etc.)

Sign, Verify, Proof Generation, Proof Verification, etc.

Commitment Generation, Commitment Verification, Blind Signing etc.

Signing Public Parameters

message 1

message 2

message 3

message L

Points of the Elliptic Curve

Need to be trusted by the Verifier

Signing Public Parameters

message 1

message 2

message 3

message L

Seed

Signing Public Parameters

message 1

message 2

message 3

message L

Seed

All the generators will be trusted

Signing Public Parameters

message 1

message 2

message 3

message L

Seed

All the generators will be trusted

NOT The Same

The signature specific generators will be trusted

Signing Public Parameters

message 1

message 2

message 3

message L

Seed

All the generators will be trusted

NOT The Same

The signature specific generators will be trusted

How the papers solves the problem??

• This makes sense when it comes to the notation of the papers

• However, it is highly impractical (for each signature the signer would need a different PK)

Signing Public Parameters

message 1

message 2

message 3

message L

Domain

Signature

Extra, always revealed, message

Signing Public Parameters

message 1

message 2

message 3

message L

Domain

Signature

Public parameters that the Verifier MUST trust

Extra, always revealed, message

Signing Public Parameters

message 1

message 2

message 3

message L

Domain

Signature

Additional representation or application specific information

This could be:

• Domain information

(blind vs non-blind signatures etc.)

Extra, always revealed, message

• Always disclosed messages.

• Or other relative info that needs to be protected

Signing Public Parameters

Message 1

Message 2

Message 3

Message L

Signature

Domain

Signing Public Parameters

Message 1

Message 2

Message 3

Message L

Signature

Domain

Signature specific parameters

Domain

Message 1

Message 2

Signing Public Parameters

Message 1

Message 2

Domain

Signature specific parameters

• Signature specific parameters can be supplied by the Holder without worrying that they may forge them (we NEVER trust the Holder).

• The Verifier trusts them because they were signed by the Issuer.

• We can also support signature domain separation and cryptographically enforced “always revealed messages” as well.

Holder Binding

BBS+ Proof Algorithm

BBS+ Proof Verification Algorithm

Proves:

• Integrity
• Authenticity

…of the revealed messages

• Ownership

…of the whole list of signed messages

AND the signature

Holder Binding

BBS+ Proof Algorithm

BBS+ Proof Verification Algorithm

Proves:

• Integrity
• Authenticity

…of the revealed messages

• Ownership

…of the whole list of signed messages

AND the signature

Holder Binding

Issuer

Verifier

Holder Binding

Issuer

Verifier

Holder Binding

Verifier

NIZK Proof

NIZK Proof

NIZK Proof

NIZK Proof

Holder Binding

Verifier

What's the problem?

NIZK Proof

NIZK Proof

NIZK Proof

NIZK Proof

• There is nothing binding a specific credential to a specific Holder.

• Usual solutions (like signing the revealed messages, DPoP etc.) introduce correlation vectors and should be avoided (or at least they should not be required).

Holder Binding

Issuer

Verifier

“commit” to a value:

1

Holder Secret

Holder Secret

Message 1

Signature

Message L

Holder Binding

Issuer

Verifier

“commit” to a value:

1

Holder Secret

Holder Secret

Message 1

Signature

Message L

Holder Binding

Issuer

Verifier

“commit” to a value:

1

Holder Secret

Message 1

Holder Binding

Issuer

Verifier

“commit” to a value:

1

Holder Secret

Idea:

• The NIZK Proof is a proof of knowledge for the whole list of messages.
• This includes the “Holder Secret”.
• Non other than the Holder (the one knowing the “Holder Secret”) will be able to create the proof.

Holder Binding

Issuer

Verifier

“commit” to a value:

1

Holder Secret

Proposals for committing a value:

• Blind Signatures

• Can “technically work” but the intent is different.
• Hard to force the “Holder Secret” to be treated differently (i.e., as a secret key).

• BLS Public Keys

• The commitment will be the public key and the “Holder Secret” the corresponding secret key.
• Will require additional “non-standard” point definitions (a new cipher suite for bls signatures).

• A BLS PoK

• Avoids the above problems but is the least studied when it comes to security.

Holder Binding

Issuer

Verifier

“commit” to a value:

1

Holder Secret

Proposals for committing a value:

• Bind Signatures

• BLS Public Keys

• A BLS PoK

In scope OR out of scope?

Conclusion

• Standardization has resulted to a clear layering as well as efficient and practical solutions to aid with the wide and secure adoption of BBS+ signatures.

• Although still in draft, there been massive progress towards a complete spec.

• BBS+ Signatures provide efficient, privacy-preserving, multi-message signatures and ZK proofs using selective disclosure.

• Always exiting seen people engaging with the spec! Let’s discuss!! ☺ `

https://github.com/decentralized-identity/bbs-signature

Thank You!!