Skip to content
unofficial ref impls of the BLS signatures standard
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
python-impl README updates Jun 14, 2019
rust-impl README updates Jun 14, 2019
sage-impl README updates Jun 14, 2019
test-vectors add sig and hash test vectors with expected outputs Jun 4, 2019

BLS signatures draft standard, reference implementations

This repository contains reference implementations of the BLS signatures draft standard.

Note: this code is WIP. It has not been audited for security, should not be assumed to be constant-time or otherwise secure, and the details may change at any time as the BLS standard evolves.

This code started as a fork of bls12-381_hash. The main differences are:

  1. This implementation hashes to base field elements using hash_to_field specified in the BLS standards WG v1 spec

  2. This implementation includes only indifferentiable hashes to G1 and G2 based on Constructions #2 and #5 of WB19.

  3. This implementation chooses the sign of the output points differently than in WB19, with the goal of easing interoperability by relaxing constraints on sqrt implementations.

    In particular, WB19 Section 4 defines maps Map1: Fp -> Ell1 and Map2: Fp^2 -> Ell2. Taking Map1 as an example (Map2 is analogous), the process is

    1. map from Fp to Ell1', a curve isogenous to Ell1
    2. evaluate the isogeny map to get a point on Ell1

    The change is in step 1: the sign of the y-coordinate of the point on Ell1' should match the sign of u, the argument to Map1. Here, a number x is regarded as "negative" if x is lexically greater than -1 * x, otherwise it is positive.

implementation status

Please see the READMEs in each subdirectory for information on particular implementations. In brief,

  • The C implementation only implements hash-to-curve, and not signing, verification, serialization, or deserialization.

  • The Python, Rust, and Sage implementations include all functionality currently specified in the standard, plus serialization and deserialization based on my proposal.

  • The Python implementation uses the Python finite field implementation from Chia's BLS library.

  • The Rust implementation is based on the Rust pairing library.


This software is (C) 2019 Riad S. Wahby

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.
You can’t perform that action at this time.