Subject: Re: [CFRG] Status of BLS Signatures CFRG Internet draft

From: Jeff Burdges <[email-masked]>
Date: Sun, 1 Aug 2021 09:01:57 +0200

Appears someone believed the BLS signature draft's flawed suggestion of actually doing multiplications in the target group.
https://github.com/zkcrypto/bls12_381/issues/68

It’s obvious one should never do multiplications in the target group, and instead always use a multi-miller loop, so not sure why the draft proposes doing target group multiplications. 

There are numerous other optimizations without which BLS signatures look fairly useless, but omitting multi-miller loops really stands out.  

Jeff

---

From: Jeff Burdges <[email-masked]>
Date: Sun, 1 Aug 2021 09:19:13 +0200

I’ve no looked too closely, but this draft seemingly ignores aggregation over identical messages.  Aggregate BLS signatures on distinct messages and keys have verification like 100 times slower than batched Ed25519 verification, making it rather pointless.  

I doubt aggregation over keys ever makes much sense, so probably worth suggesting that BLS only makes sense when doing same message aggregation, which mostly limits use cases to consensus protocols.  

> On 1 Aug 2021, at 09:01, Jeff Burdges <[email-masked]> wrote:
>