1# toy implementation of BLS signatures
 2
 3load("bls12-381.sage")
 4from hashlib import sha256
 5
 6def hash(m):
 7    h_output = sha256(str(m).encode('utf-8'))
 8    return int(h_output.hexdigest(), 16)
 9
10def hash_to_point(m):
11    # WARNING this hash-to-point approach should not be used!
12    h = hash(m)
13    return e.G2 * h
14
15
16e = Pairing()
17
18class Signer:
19    def __init__(self):
20        self.sk = e.F1.random_element()
21        self.pk = self.sk * e.G1
22
23    def sign(self, m):
24        H = hash_to_point(m)
25        return self.sk * H
26
27def verify(pk, s, m):
28    H = hash_to_point(m)
29    return e.pair(e.G1, s) == e.pair(pk, H)
30
31def aggr(points):
32    R = 0
33    for i in range(len(points)):
34        R = R + points[i]
35    return R
36
37
38m = 1234
39
40# single signature & verification
41user0 = Signer()
42s = user0.sign(m)
43v = verify(user0.pk, s, m)
44assert v
45
46
47# BLS signature aggregation
48n = 10
49users = [None]*n
50pks = [None]*n
51sigs = [None]*n
52for i in range(n):
53    users[i] = Signer()
54    pks[i] = users[i].pk
55    sigs[i] = users[i].sign(m)
56
57# aggregate sigs & pks
58s_aggr = aggr(sigs)
59pk_aggr = aggr(pks)
60
61# verify aggregated signature
62v = verify(pk_aggr, s_aggr, m)
63assert v