Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@mattrglobal/node-bbs-signatures
Advanced tools
Changelog
Readme
This repository is the home to a performant multi-message digital signature algorithm implementation which supports deriving zero knowledge proofs that enable selective disclosure from the originally signed message set.
BBS+ Signatures are a digital signature algorithm originally born from the work on Short group signatures by Boneh, Boyen, and Shachum which was later improved on in Constant-Size Dynamic k-TAA as BBS+ and touched on again in section 4.3 in Anonymous Attestation Using the Strong Diffie Hellman Assumption Revisited .
BBS+ Signatures require a pairing-friendly curve, this library includes support for BLS12-381.
BBS+ Signatures allow for multi-message signing whilst producing a single output signature. With a BBS signature, a proof of knowledge based proof can be produced where only some of the originally signed messages are revealed at the discretion of the prover.
To use this package within your project simply run
npm install @mattrglobal/node-bbs-signatures
Or with Yarn
yarn add @mattrglobal/node-bbs-signatures
See the sample directory for a runnable demo.
The following is a short sample on how to use the API
import {
generateBls12381G2KeyPair,
blsSign,
blsVerify,
blsCreateProof,
blsVerifyProof,
} from "@mattrglobal/node-bbs-signatures";
//Generate a new key pair
const keyPair = await generateBls12381G2KeyPair();
//Set of messages we wish to sign
const messages = [Uint8Array.from(Buffer.from("message1", "utf-8")), Uint8Array.from(Buffer.from("message2", "utf-8"))];
//Create the signature
const signature = await blsSign({
keyPair,
messages: messages,
});
//Verify the signature
const isVerified = await blsVerify({
publicKey: keyPair.publicKey,
messages: messages,
signature,
});
//Derive a proof from the signature revealing the first message
const proof = await blsCreateProof({
signature,
publicKey: keyPair.publicKey,
messages,
nonce: Uint8Array.from(Buffer.from("nonce", "utf8")),
revealed: [0],
});
//Verify the created proof
const isProofVerified = await blsVerifyProof({
proof,
publicKey: keyPair.publicKey,
messages: messages.slice(0, 1),
nonce: Uint8Array.from(Buffer.from("nonce", "utf8")),
});
Within a digital signature there are several elements for which it is useful to know the size, the following table outlines the general equation for calculating element sizes in relation to BBS+ signatures as it is dependent on the pairing friendly curve used.
Element | Size Equation |
---|---|
Private Key | F |
Public Key | G2 |
Signature | G1 + 2*F |
Proof | 5*G1 + (4 + no_of_hidden_messages)*F |
F
A field elementG1
A point in the field of G1G2
A point in the field of G2no_of_hidden_messages
The number of the hidden messagesThis library includes specific support for BLS12-381 keys with BBS+ signatures and hence gives rise to the following concrete sizes
Element | Size with BLS12-381 |
---|---|
Private Key | 32 Bytes |
Public Key | 96 Bytes |
Signature | 112 Bytes |
Proof | 368 + (no_of_hidden_messages)*32 Bytes |
The following describes how to get started as a contributor to this project
The following is a list of dependencies you must install to build and contribute to this project
For more details see our contribution guidelines
To install the package dependencies run:
yarn install --frozen-lockfile
To build the project run:
yarn build
To run the test in the project run:
yarn test
To benchmark the implementation locally run:
yarn benchmark
This library uses the bbs rust crate for the implementation of BBS+ signatures and BLS12-381 which is then wrapped and exposed in javascript/typescript using neon-bindings.
Please see our security policy for additional details about responsible disclosure of security related issues.
Copyright © MATTR Limited. Some rights reserved.
“MATTR” is a trademark of MATTR Limited, registered in New Zealand and other countries.
FAQs
An implementation of BBS+ signatures using rust and typescript for node.js
The npm package @mattrglobal/node-bbs-signatures receives a total of 5,582 weekly downloads. As such, @mattrglobal/node-bbs-signatures popularity was classified as popular.
We found that @mattrglobal/node-bbs-signatures demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.