Class BLS12_381Aggregation

java.lang.Object
org.bouncycastle.crypto.bls.BLS12_381Aggregation
public class BLS12_381Aggregation extends Object
Helper for aggregating BLS12-381 signatures and verifying aggregates.

Aggregation itself is suite-independent — it is just point addition in G2. The aggregate-verify equation e(G1_gen, sig_agg) == prod_i e(pk_i, H(msg_i)) collapses to a single multi-pairing check multiPair([(-G1_gen, sig_agg), (RK_1, H_1), ...]) == 1, where each H_i is a distinct hashed-message G2 point and RK_i is the sum of all public keys that signed the corresponding message — the "QK_set" aggregation from draft-irtf-cfrg-bls-signature sec. 2.9. Each suite computes its own list of hashed-message G2 points (BasicScheme: H(msg) with NUL DST; MessageAugmentation: H(pk || msg) with AUG DST; ProofOfPossession: H(msg) with POP DST) and then defers to aggregateVerifyHashed(ECPoint[], BLS12_381G2Point[], BLS12_381G2Point), which performs the message-grouping plus a single final exponentiation regardless of how many signers participated.

  • Method Details

    • aggregate

      public static BLS12_381G2Point aggregate(BLS12_381G2Point[] signatures)
      Aggregate a list of BLS signatures by summing them in G2.
      Parameters:
      signatures - one or more BLS signatures (G2 points). Must be non-empty.
      Returns:
      sig_1 + sig_2 + ... + sig_n.