signature scheme:
- key_gen:
public_key = generator^priv
- sign:
signature = H(m)^priv
- verify:
pairing(signature, generator) = pairing(H(m), public_key)
properties:
- signatures are unique and deterministic
- you can do simple threshold signatures with them
- you can compress signatures (signature aggregation)
- 2001 - Dan Boneh, Ben Lynn, and Hovav Shacham - Short signatures from the Weil pairing
- 2007 - Ben Lynn - On the Implementation of Pairing-Based Cryptosystems
- 2018 - Dan Boneh and Manu Drijvers and Gregory Neven - Compact Multi-Signatures for Smaller Blockchains
- 2018 - Dan Boneh and Benedikt Bünz and Ben Fisch - Batching Techniques for Accumulators with Applications to IOPs and Stateless Blockchains
- 2019 - Riad S. Wahby and Dan Boneh - Fast and simple constant-time hashing to the BLS12-381 elliptic curve
- 2019 - Sean Bowe - Faster Subgroup Checks for BLS12-381
- 2018 - BLS signatures: better than Schnorr
- 2017 - Vitalik Buterin - Exploring Elliptic Curve Pairings