Skip to content

[bls-signatures] Add support for custom payloads for bls PoP #452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
samkim-crypto merged 1 commit into from
Nov 25, 2025
Merged

[bls-signatures] Add support for custom payloads for bls PoP #452

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions bls-signatures/benches/bls_signatures.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,15 +112,15 @@ fn bench_key_generation(c: &mut Criterion) {
// Benchmark for creating and verifying a proof of possession
fn bench_proof_of_possession(c: &mut Criterion) {
let keypair = Keypair::new();
let pop = keypair.proof_of_possession();
let pop = keypair.proof_of_possession(None);

c.bench_function("proof_of_possession_creation", |b| {
b.iter(|| black_box(keypair.proof_of_possession()));
b.iter(|| black_box(keypair.proof_of_possession(None)));
});

c.bench_function("proof_of_possession_verification", |b| {
b.iter(|| {
black_box(keypair.public.verify_proof_of_possession(&pop)).unwrap();
black_box(keypair.public.verify_proof_of_possession(&pop, None)).unwrap();
})
});
}
Expand Down
13 changes: 10 additions & 3 deletions bls-signatures/src/hash.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,14 @@ pub fn hash_message_to_point(message: &[u8]) -> G2Projective {
}

/// Hash a pubkey to a G2 point
pub(crate) fn hash_pubkey_to_g2(public_key: &PubkeyProjective) -> G2Projective {
let pubkey_bytes = public_key.0.to_compressed();
G2Projective::hash_to_curve(&pubkey_bytes, POP_DST, &[])
pub(crate) fn hash_pubkey_to_g2(
public_key: &PubkeyProjective,
payload: Option<&[u8]>,
) -> G2Projective {
if let Some(bytes) = payload {
G2Projective::hash_to_curve(bytes, POP_DST, &[])
Copy link
Copy Markdown
Contributor

@zz-sol zz-sol Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits: this means bytes = Some(&[]) and bytes=None have different outputs. Is this behavior acceptable? Or should bytes=None also hash the public key?

Copy link
Copy Markdown
Contributor Author

@samkim-crypto samkim-crypto Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I was thinking that this is acceptable.

I originally made the function take in prefix: Option<&[u8]> instead. It would then concatenate prefix || pubkey_bytes and then use this as the payload. This is probably the safer API because the public key will always be hashed. But if someone wants to add a suffix instead of prefix pubkey_bytes || suffix, for example, they cannot use this API. This is why I made the function to take in paylod: Option<&[u8]> instead.

I think hashing on bytes = Some(&[]) is not any safer than hashing any other string that does not have the public key bytes in it anyway, so there doesn't seem to be a justification to specialize for this case. Of course, if you think specializing addressing the case Some(&[]) to hash the public key bytes instead, then let me know 😄

Copy link
Copy Markdown
Contributor

@zz-sol zz-sol Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds good to me

} else {
let public_key_bytes = public_key.0.to_compressed();
G2Projective::hash_to_curve(&public_key_bytes, POP_DST, &[])
}
}
4 changes: 2 additions & 2 deletions bls-signatures/src/keypair.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,8 @@ impl Keypair {
}

/// Generate a proof of possession for the given keypair
pub fn proof_of_possession(&self) -> ProofOfPossessionProjective {
self.secret.proof_of_possession()
pub fn proof_of_possession(&self, payload: Option<&[u8]>) -> ProofOfPossessionProjective {
self.secret.proof_of_possession(payload)
}

/// Sign a message using the provided secret key
Expand Down
67 changes: 54 additions & 13 deletions bls-signatures/src/proof_of_possession.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ use {
/// Domain separation tag used when hashing public keys to G2 in the proof of
/// possession signing and verification functions. See the
/// [standard](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-bls-signature-05#section-4.2.3).
pub const POP_DST: &[u8] = b"BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_POP_";
pub const POP_DST: &[u8] = b"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_";
Copy link
Copy Markdown
Contributor Author

@samkim-crypto samkim-crypto Nov 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I also realized that this domain separation tag was written for G1 while we hash the message on G2 for PoP, so I fixed this.


/// Size of a BLS proof of possession in a compressed point representation
pub const BLS_PROOF_OF_POSSESSION_COMPRESSED_SIZE: usize = 96;
Expand Down Expand Up @@ -50,9 +50,13 @@ pub trait AsProofOfPossession {
#[cfg(not(target_os = "solana"))]
pub trait VerifiableProofOfPossession: AsProofOfPossessionProjective {
/// Verifies the proof of possession against any convertible public key type.
fn verify<P: VerifiablePubkey>(&self, pubkey: &P) -> Result<bool, BlsError> {
fn verify<P: VerifiablePubkey>(
&self,
pubkey: &P,
payload: Option<&[u8]>,
) -> Result<bool, BlsError> {
let proof_projective = self.try_as_projective()?;
pubkey.verify_proof_of_possession(&proof_projective)
pubkey.verify_proof_of_possession(&proof_projective, payload)
}
}

Expand Down Expand Up @@ -172,7 +176,7 @@ mod tests {
#[test]
fn test_proof_of_possession() {
let keypair = Keypair::new();
let proof_projective = keypair.proof_of_possession();
let proof_projective = keypair.proof_of_possession(None);

let pubkey_projective: PubkeyProjective = (&keypair.public).try_into().unwrap();
let pubkey_affine: Pubkey = keypair.public;
Expand All @@ -181,17 +185,17 @@ mod tests {
let proof_affine: ProofOfPossession = proof_projective.into();
let proof_compressed: ProofOfPossessionCompressed = proof_affine.try_into().unwrap();

assert!(proof_projective.verify(&pubkey_projective).unwrap());
assert!(proof_affine.verify(&pubkey_projective).unwrap());
assert!(proof_compressed.verify(&pubkey_projective).unwrap());
assert!(proof_projective.verify(&pubkey_projective, None).unwrap());
assert!(proof_affine.verify(&pubkey_projective, None).unwrap());
assert!(proof_compressed.verify(&pubkey_projective, None).unwrap());

assert!(proof_projective.verify(&pubkey_affine).unwrap());
assert!(proof_affine.verify(&pubkey_affine).unwrap());
assert!(proof_compressed.verify(&pubkey_affine).unwrap());
assert!(proof_projective.verify(&pubkey_affine, None).unwrap());
assert!(proof_affine.verify(&pubkey_affine, None).unwrap());
assert!(proof_compressed.verify(&pubkey_affine, None).unwrap());

assert!(proof_projective.verify(&pubkey_compressed).unwrap());
assert!(proof_affine.verify(&pubkey_compressed).unwrap());
assert!(proof_compressed.verify(&pubkey_compressed).unwrap());
assert!(proof_projective.verify(&pubkey_compressed, None).unwrap());
assert!(proof_affine.verify(&pubkey_compressed, None).unwrap());
assert!(proof_compressed.verify(&pubkey_compressed, None).unwrap());
}

#[test]
Expand Down Expand Up @@ -240,4 +244,41 @@ mod tests {
let deserialized: ProofOfPossessionCompressed = bincode::deserialize(&serialized).unwrap();
assert_eq!(original, deserialized);
}

#[test]
fn test_proof_of_possession_with_custom_payload() {
let keypair = Keypair::new();
let custom_payload = b"SIMD-0387-context-data";

let proof_custom = keypair.proof_of_possession(Some(custom_payload));
assert!(keypair
.public
.verify_proof_of_possession(&proof_custom, Some(custom_payload))
.unwrap());

assert!(!keypair
.public
.verify_proof_of_possession(&proof_custom, None) // try verify with `None`
.unwrap());

let wrong_payload = b"wrong-context";
assert!(!keypair
.public
// try verify with wrong payload
.verify_proof_of_possession(&proof_custom, Some(wrong_payload))
.unwrap());

// verify standard PoP behavior
let proof_standard = keypair.proof_of_possession(None);
// standard passes with None
assert!(keypair
.public
.verify_proof_of_possession(&proof_standard, None)
.unwrap());
// standard fails with custom payload
assert!(!keypair
.public
.verify_proof_of_possession(&proof_standard, Some(custom_payload))
.unwrap());
}
}
31 changes: 18 additions & 13 deletions bls-signatures/src/pubkey.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,10 +75,11 @@ pub trait VerifiablePubkey: AsPubkey {
fn verify_proof_of_possession<P: AsProofOfPossession>(
&self,
proof: &P,
payload: Option<&[u8]>,
) -> Result<bool, BlsError> {
let pubkey_affine = self.try_as_affine()?;
let proof_affine = proof.try_as_affine()?;
Ok(pubkey_affine._verify_proof_of_possession(&proof_affine))
Ok(pubkey_affine._verify_proof_of_possession(&proof_affine, payload))
}
}

Expand Down Expand Up @@ -274,7 +275,11 @@ impl Pubkey {
}

/// Verify a proof of possession against a public key
pub(crate) fn _verify_proof_of_possession(&self, proof: &ProofOfPossession) -> bool {
pub(crate) fn _verify_proof_of_possession(
&self,
proof: &ProofOfPossession,
payload: Option<&[u8]>,
) -> bool {
let Some(pubkey_affine): Option<G1Affine> = G1Affine::from_uncompressed(&self.0).into()
else {
return false;
Expand All @@ -289,7 +294,7 @@ impl Pubkey {

// The verification equation is e(pubkey, H(pubkey)) == e(g1, proof).
// This is rewritten to e(pubkey, H(pubkey)) * e(-g1, proof) = 1 for batching.
let hashed_pubkey_affine: G2Affine = hash_pubkey_to_g2(&pubkey_projective).into();
let hashed_pubkey_affine: G2Affine = hash_pubkey_to_g2(&pubkey_projective, payload).into();
let hashed_pubkey_prepared = G2Prepared::from(hashed_pubkey_affine);
let proof_prepared = G2Prepared::from(proof_affine);

Expand Down Expand Up @@ -407,7 +412,7 @@ mod tests {
#[test]
fn test_pubkey_verify_proof_of_possession() {
let keypair = Keypair::new();
let proof_projective = keypair.proof_of_possession();
let proof_projective = keypair.proof_of_possession(None);

let pubkey_projective: PubkeyProjective = (&keypair.public).try_into().unwrap();
let pubkey_affine: Pubkey = pubkey_projective.into();
Expand All @@ -417,33 +422,33 @@ mod tests {
let proof_compressed: ProofOfPossessionCompressed = proof_affine.try_into().unwrap();

assert!(pubkey_projective
.verify_proof_of_possession(&proof_projective)
.verify_proof_of_possession(&proof_projective, None)
.unwrap());
assert!(pubkey_affine
.verify_proof_of_possession(&proof_projective)
.verify_proof_of_possession(&proof_projective, None)
.unwrap());
assert!(pubkey_compressed
.verify_proof_of_possession(&proof_projective)
.verify_proof_of_possession(&proof_projective, None)
.unwrap());

assert!(pubkey_projective
.verify_proof_of_possession(&proof_affine)
.verify_proof_of_possession(&proof_affine, None)
.unwrap());
assert!(pubkey_affine
.verify_proof_of_possession(&proof_affine)
.verify_proof_of_possession(&proof_affine, None)
.unwrap());
assert!(pubkey_compressed
.verify_proof_of_possession(&proof_affine)
.verify_proof_of_possession(&proof_affine, None)
.unwrap());

assert!(pubkey_projective
.verify_proof_of_possession(&proof_compressed)
.verify_proof_of_possession(&proof_compressed, None)
.unwrap());
assert!(pubkey_affine
.verify_proof_of_possession(&proof_compressed)
.verify_proof_of_possession(&proof_compressed, None)
.unwrap());
assert!(pubkey_compressed
.verify_proof_of_possession(&proof_compressed)
.verify_proof_of_possession(&proof_compressed, None)
.unwrap());
}

Expand Down
6 changes: 3 additions & 3 deletions bls-signatures/src/secret_key.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,10 @@ impl SecretKey {

/// Generate a proof of possession for the corresponding pubkey
#[allow(clippy::arithmetic_side_effects)]
pub fn proof_of_possession(&self) -> ProofOfPossessionProjective {
pub fn proof_of_possession(&self, payload: Option<&[u8]>) -> ProofOfPossessionProjective {
let pubkey = PubkeyProjective::from_secret(self);
let hashed_pubkey_bytes = hash_pubkey_to_g2(&pubkey);
ProofOfPossessionProjective(hashed_pubkey_bytes * self.0)
let hashed_point = hash_pubkey_to_g2(&pubkey, payload);
ProofOfPossessionProjective(hashed_point * self.0)
}

/// Sign a message using the provided secret key
Expand Down