BLS Signature

A BLS signature is a digital signature scheme built on bilinear pairings over pairing-friendly elliptic curves, named after its inventors Dan Boneh, Ben Lynn, and Hovav Shacham, who published it in 2001. Its defining property is aggregation: thousands of independent signatures, over distinct messages and from distinct keys, can be compressed into a single constant-size signature that verifies in roughly the time of one. That single property made BLS the backbone of large proof-of-stake consensus systems, where tens of thousands of validators must attest to every slot and storing or verifying each signature individually would be ruinous.

How signing and aggregation work

BLS signing is disarmingly simple. The message is hashed to a point on the curve, and the signer multiplies that point by their private key — the resulting point is the signature, a single compact group element with no per-signature randomness to manage. Verification uses a bilinear pairing: a special map that lets a verifier check, in one equation, that the signature was produced by the claimed public key over the claimed message. Bilinearity is also what makes aggregation possible — the sum of several signatures verifies against the corresponding set of public keys and messages in one combined pairing check. Where Schnorr-style multisignatures typically require interaction among signers or leave per-signer overhead, BLS aggregation is non-interactive: anyone can collect independently produced signatures after the fact and roll them into one. The mathematics underneath is covered in our elliptic curve pairing entry.

Where it runs — and what it costs

The scheme is typically instantiated on the BLS12-381 curve, chosen for roughly 128-bit security and efficient pairings. It secures Ethereum's proof-of-stake attestations, Filecoin's consensus, and several drand randomness beacons, and it is a natural fit for threshold signing, where key shares combine as smoothly as signatures do. The costs are real, though. Pairing operations are substantially heavier than the plain elliptic-curve arithmetic behind ECDSA or Schnorr, so single-signature verification is slower — BLS wins only when aggregation amortizes that cost across many signatures. And naive aggregation is vulnerable to rogue-key attacks, where an adversary crafts a public key as a function of honest keys to forge an aggregate; deployments defend with proof-of-possession (prove you hold the private key before your public key is accepted) or message augmentation.

Why Bitcoin doesn't use it

Bitcoin chose a different branch of the same tree. Taproot introduced the Schnorr signature on secp256k1 — no pairings, cheaper verification, and signatures that are believed secure under weaker assumptions than pairing-based schemes require. Schnorr enables key and signature aggregation within a transaction through protocols like MuSig2, which is what practical multisig needs, without importing new curves or the stronger cryptographic assumptions that pairings entail. BLS's cross-message, non-interactive aggregation is more powerful, but Bitcoin's conservatism prices assumptions, not just features: a pairing break would be catastrophic, and the protocol's guardians have judged that trade not worth taking. It is a useful case study in how two sound engineering cultures weigh elegance against attack surface differently.

The bigger family

BLS belongs to a broader toolkit of pairing-based cryptography that also yields identity-based encryption and the succinct proofs behind modern commitment schemes. If the idea of one short object attesting to many things appeals, the natural next stop is the vector commitment — a primitive that commits to a whole vector of values yet opens any position with a constant-size proof — and the KZG polynomial commitment built on the same pairing machinery. For a sovereignty-minded reader, the takeaway is architectural: aggregation is how large decentralized systems stay verifiable by small machines, and BLS is the sharpest tool yet built for that job.