Pragmatic signature aggregation with BLS

[JustinDrake]

I don’t understand the concern of your last two replies. Are you worried about the costs of registering a new BLS public key?

@burdges

if accounts are single use

Accounts are not at all single use. Keep in mind that the deregistration period of a validator will be ~4 months, and that every validator is invited to make a signature every ~5 second for attestations. So validator accounts will likely be making millions of BLS signatures in their life time with the same public key.

@burdges

If you means some smallish set, then no because an adversary could corrupt that entire set, and then submit false transactions.

I don’t understand this sentence. Set of what? What false transactions?

@burdges

We already can aggregate the proofs of possession because they are on different messages

Right, we could aggregate proofs of possession for ~2x reduced verification costs. But is the extra complexity worth it? Without aggregation each proof of possession takes ~5ms to verify so even assuming conservatively 100,000 registrations per month that’s ~4 minutes of verification time saved per month.

@burdges

one exponentiation per key for Dan’s scheme should be dramatically faster

The one-time proof of possession might be slower to verify than an exponential, but then every single signature (of which there are millions per public key) would be faster to verify.