1\documentclass{article}
 2\usepackage[utf8]{inputenc}
 3\usepackage{amsfonts}
 4\usepackage{amsthm}
 5\usepackage{amsmath}
 6\usepackage{enumerate}
 7\usepackage{hyperref}
 8\hypersetup{
 9    colorlinks,
10    citecolor=black,
11    filecolor=black,
12    linkcolor=black,
13    urlcolor=blue
14}
15\usepackage{xcolor}
16
17% prevent warnings of underfull \hbox:
18\usepackage{etoolbox}
19\apptocmd{\sloppy}{\hbadness 4000\relax}{}{}
20
21\theoremstyle{definition}
22\newtheorem{definition}{Def}[section]
23\newtheorem{theorem}[definition]{Thm}
24
25
26\title{Notes on BLS Signatures}
27\author{arnaucube}
28\date{July 2022}
29
30\begin{document}
31
32\maketitle
33
34\begin{abstract}
35	Notes taken while reading about BLS signatures \cite{bls-sig-eth2}. Usually while reading papers I take handwritten notes, this document contains some of them re-written to $LaTeX$.
36
37	The notes are not complete, don't include all the steps neither all the proofs.
38\end{abstract}
39
40% \tableofcontents
41
42\section{BLS signatures}
43
44\paragraph{Key generation}
45$sk \in \mathbb{Z}_q$, $pk = [sk] \cdot g_1$, where $g_1 \in G_1$, and is the generator.
46
47\paragraph{Signature}
48$$\sigma = [sk] \cdot H(m)$$
49where $H$ is a function that maps to a point in $G_2$. So $H(m), \sigma \in G_2$.
50
51\paragraph{Verification}
52$$e(g_1, \sigma) == e(pk, H(m))$$
53
54Unfold:
55$$e(pk, H(m)) = e([sk] \cdot g_1, H(m) = e(g_1, H(m))^{sk} = e(g_1, [sk] \cdot H(m)) = e(g_1, \sigma))$$
56
57\paragraph{Aggregation}
58Signatures aggregation:
59$$\sigma_{aggr} = \sigma_1 + \sigma_2 + \ldots + \sigma_n$$
60where $\sigma_{aggr} \in G_2$, and an aggregated signatures is indistinguishable from a non-aggregated signature.
61
62\vspace{0.5cm}
63Public keys aggregation:
64$$pk_{aggr} = pk_1 + pk_2 + \ldots + pk_n$$
65where $pk_{aggr} \in G_1$, and an aggregated public keys is indistinguishable from a non-aggregated public key.
66
67
68\paragraph{Verification of aggregated signatures}
69Identical to verification of a normal signature as long as we use the same corresponding aggregated public key:
70$$e(g_1, \sigma_{aggr})==e(pk_{aggr}, H(m))$$
71
72Unfold:
73$$e(pk_{aggr}, H(m))= e(pk_1 + pk_2 + \ldots + pk_n, H(m)) =$$
74$$=e([sk_1] \cdot g_1 + [sk_2] \cdot g_1 + \ldots + [sk_n] \cdot g_1, H(m))=$$
75$$=e([sk_1 + sk_2 + \ldots + sk_n] \cdot g_1, H(m))=$$
76$$=[sk_1 + sk_2 + \ldots + sk_n]~\cdot~e(g_1, H(m))=$$
77$$=e(g_1, [sk_1 + sk_2 + \ldots + sk_n] \cdot H(m))=$$
78$$=e(g_1, [sk_1] \cdot H(m) + [sk_2] \cdot H(m) + \ldots + [sk_n] \cdot H(m))=$$
79$$=e(g_1, \sigma_1 + \sigma_2 + \ldots + \sigma_n)= e(g_1, \sigma_{aggr})$$
80
81
82Note: in the current notes $pk \in G_1$ and $\sigma, H(m) \in G_2$, but we could use $\sigma, H(m) \in G_1$ and $pk \in G_2$.
83
84\bibliography{paper-notes.bib}
85\bibliographystyle{unsrt}
86
87\end{document}