5. BLS aggregation by Vitalik Buterin and Justin Drake (Ethereum Foundation)

[Music] which was responsible for [Music] over a finite field and [Music] in terms of performance the performance [Music] [Music] about 2.5 milliseconds maybe optimizable to something like one millisecond so that's the ballpark in my finance 0.4 seconds and with pipe is 0.15 for this case Python is slow for what it's worth like they're the proof of concept Python implementation that I made basically contains an implementation of all of us so if we think about not just the signatures themselves but the actual mechanics of aggregation right you could also think that you don't even have to have to store all the public keys and run potentially because because these signature aggregation is associative and commutative so what you can actually do is that you can group them up as they get aggregated and actually verify at each point so I've received two messages which have two different aggregates I verified them and then I passed them on is another aggregate and then you just have a very efficient aggregation mechanics some nodes are gonna be missing from these bit fields it's you're having to add up things in the bit fields but yeah so if the bit fields are mostly full or or something than you could imagine it being faster to subtract the nodes that aren't there or stuff like that you know it's a very good point I mean another optimization kind of at the networking layer is instead of having a proposer be in charge of aggregating all the other stations for his own proposal it could be the next proposal who does that so you have proposal all the various signatures and then the next proposal isolation so from a networking standpoint you kind of reduce half a round-trip or roundtrip we that reduces the number of network trips but it's mean a more like in the successive walk for two to one now it might make sense to increase the number of networks somewhat because once you go into having like 50,000 keys in one message then you start running into the issue that like can one propose or really download and add up 50,000 signatures and like if that becomes an issue then you can do a shorted aggregation so basically you can imagine a node in a peer-to-peer network deciding to specialize it and say some particular chunk of the bid field and then like one participant would say I aggregate all that they know about say the first 500 another whatever you'd only know about the second 500 and then you can have each participant aggregate square root of n instead of n and that basically gives you all the efficiency you want instead the proposal closer to getting signature from each other that's a naive way of doing it and as the naive way of doing it becomes too inefficient which would probably smite could start happening as we move from like small sets of alders to the live net with like four you know like 400,000 or whatever validators total then it would make sense to add in some kind of this kind of two-level shorted aggregation structure and you sort of like target someone for can you target someone for exclusion during this like aggregation process and what you can probably do is you can basically you can though like in this like if we do this kind of okay so first of all there's two aspects right so in the simplest model where the proposer has to aggregate all the signatures then yes the proposer can exclude whoever they want up to a maximum of like whatever the minimum number is that they have to include but then from what we're doing from any can you from a four choice rule standpoint first of all you can still count them if you want to because you can use like ghosts and from an incentivization stand points like you can have in from generally from an accounting standpoint you can allow any of the messages that were not encoded to become included in the next block okay yeah but on if you said that their parameters of the of the curve were not found but somehow the crypto gods have given them so what did you really mean seriously basically the idea is that actually generating these curves that have that have this specific set up that they are appearing compatible they require very specific properties of how the numbers work and even something like calculating how many points there are in a curve what this requires extremely advanced algorithms that are can we do it fortunately we don't have to because we can just use the BLS 1231 parameters they already did it yeah yeah they're ready and the second question is that maybe I've missed it but do we always already have that hash function as well yeah the hash function which maps into a group yes okay we have that as well yes so I originally implementable yes yes totally implementable no for the hash function like I already did it and like Indian Binet gave the glue the green lights of the approach which is you basically hash into the x-coordinate and then you derived the y-coordinate from the x-coordinate so that will you generate a point that you don't know the corresponding uh discrete log for that's where basically the one thing that matters I mean it's quite old crypto and other than the new curve which is quite recent but it has been audited another good thing is that there's a bunch of other projects in the blockchain space who are starting to use VLS so Definity I learned about polka dot today this gr and just in general it seems that there's more awareness around this and I think even Bitcoin is considering the other signatures as an alternative to small maybe is this a signature scheme you're considering to be like the kind of enshrined base signatures came for the transactions and esque execution there so my personal answer is that I prefer the execution layer to have nothing in shrine and to just be a computation framework yeah so signature abstraction account attraction that addition in the shots it's the curved part of any official standard like I don't know niste or ice or anything because otherwise it might come with funky export restrictions or problems on Apple devices and things like this I believe the only project that is intending to use it and it's not even using it right now is easy cash I mean it is part of a family of curves but yeah they have an implementation in rust which they've also audited so they voted to the implementation and the curve separately and the number is two point five milliseconds that's from this specific rust implementation and I believe Shaun Bowie who is leading the effort you know spent a long time maybe two years writing this library the specific curve also chia intense Chia Network intends to use it