# BLS Boneh–Lynn–Shacham Threshold Signature Aggregation + Distributed Key Generation Simulator

Simulate BLS12-381 BLS signatures end to end: Joint-Feldman DKG ceremonies, t-of-n threshold signing with Lagrange interpolation, the rogue-key attack and its proof-of-possession defense, and Ethereum 2 attestation aggregation.

> Canonical page: https://elysiatools.com/en/tools/bls-boneh-lynn-shacham-threshold-signature-aggregation-distributed-key-gen-simulator

- **Category:** Cryptography

- **Keywords:** bls signature simulator, bls12-381, threshold signatures, dkg ceremony, joint feldman, rogue key, proof of possession, ethereum 2 bls, attestation aggregation, lagrange interpolation shamir

## Overview

An educational simulator for the BLS signature scheme (Boneh–Lynn–Shacham 2001, standardized in draft-irtf-cfrg-bls-signature-04) — the scheme behind Ethereum 2 beacon-chain attestations, Chia, Polkadot and Filecoin.

The scalar field is the real BLS12-381 subgroup order r, so secret keys, Shamir shares, Lagrange coefficients and rogue-key cancellations use the exact production modulus. The group is a didactic prime-order multiplicative group with the abstract pairing e(g^a, g^b) = g^(ab): every bilinear identity BLS relies on (σ = H(m)^sk verifying as e(σ, g) = e(H(m), g^sk)) is preserved; elliptic-curve and hash-to-curve (SSWU) arithmetic is not exercised.

Scenarios:

1. Joint-Feldman DKG — every participant deals a random degree-(t−1) polynomial, publishes Feldman commitments C_i,k = g^{a_i,k} (plus optional Pedersen hiding commitments), and privately distributes shares. Share checks expose crooked dealers; the group public key Π C_i,0 equals g^{group secret} although the secret never materializes. Then t-of-n threshold signing: partials σ_i = H(m)^{s_i} combine via Lagrange coefficients into a signature identical to the full signer’s; sub-threshold quorums are rejected.

2. Rogue-key attack — an attacker publishes pk* = g^α·Πpkᵢ⁻¹ (computable from public keys alone) and forges an aggregate signature that plain verification accepts. The proof-of-possession defense (PopProve = sign the hash of your own public key) rejects the rogue key at registration.

3. Ethereum 2 attestation aggregation — n validators sign the same attestation data; σ_agg = Πσᵢ stays 96 bytes and FastAggregateVerify costs 2 pairings regardless of n; the ⅔ quorum sub-aggregate verifies incrementally.

All runs are deterministic given the seed text, so ceremonies replay identically.

## Inputs

- **Scenario** (select)
- **Participants n (3–9)** (number): 4
- **Threshold t (2–9)** (number): 3
- **Message / Attestation Data** (text): committee attestation: block 9182
- **Deterministic Seed (replays the same ceremony)** (text): ceremony-2026
- **Add Pedersen hiding commitments to the DKG** (checkbox)

## When to use

- Verify how Joint-Feldman Distributed Key Generation (DKG) derives a group public key without assembling the underlying secret.
- Demonstrate how rogue-key attacks compromise plain BLS aggregation and how Proof of Possession (PoP) stops malicious key cancellation.
- Inspect the mechanics of Ethereum 2 beacon-chain attestation aggregation and FastAggregateVerify pairing batching.

## How it works

- Select a scenario such as Joint-Feldman DKG, rogue-key attack defense, or Ethereum 2 attestation aggregation.
- Configure committee size (n), threshold (t), attestation message text, deterministic seed, and optional Pedersen commitments.
- The simulator computes secret shares, Feldman commitment matrices, Lagrange interpolation coefficients, or aggregate signatures over the BLS12-381 scalar field.
- Review the generated HTML report displaying mathematical step-by-step commitment checks, quorum validations, and verification pairings.

## Use cases

- Auditing threshold quorum math and Shamir share verification steps for validator custody setups.
- Teaching cryptographic engineers how algebraic cancellation enables rogue-key forging without knowledge of private keys.
- Prototyping beacon-chain consensus mechanisms and FastAggregateVerify pairing costs across validator sub-committees.

## Frequently asked questions

### Does this tool execute full elliptic-curve pairing math?

It computes polynomial sharing and arithmetic over the authentic BLS12-381 scalar field r while evaluating pairings via an abstract bilinear multiplicative model.

### What is the purpose of the deterministic seed input?

The seed initializes the pseudo-random generator so that polynomial coefficients, private shares, and keys can be replayed identically.

### Why does a threshold signature match the full signer's signature?

Lagrange basis polynomials reconstruct the evaluated secret at point zero f(0), producing an aggregate signature mathematically indistinguishable from one created by the full private key.

### How does Proof of Possession (PoP) neutralize rogue-key attacks?

PoP requires signers to submit a signature over their own public key upon registration, which an attacker with an artificially constructed key cannot produce.

### How large is an aggregated BLS signature in Ethereum 2 attestations?

A BLS signature remains fixed at 96 bytes regardless of how many validator signatures are multiplied together.

## Related tools

- [Hash Algorithm Comparator](https://elysiatools.com/en/tools/hash-algorithm-comparator): Hash the same input with MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, and BLAKE3 at the same time and compare them side by side: output length, hex/Base64 digest, security status (broken / modern), and a relative speed benchmark. Great for teaching, choosing a hashing algorithm, or sanity-checking checksums.
- [HMAC + BLAKE3 + SHA-3/Keccak + Poly1305 + BLAKE2 Keyed MAC Construction Linter](https://elysiatools.com/en/tools/hmac-blake3-sha3-keccak-keyed-hash-and-mac-construction-linter): Compute and audit MACs across HMAC-SHA-2/SHA-3, keyed BLAKE2, BLAKE3, KMAC and Poly1305 with official known-answer self-tests, key/tag-length linting and a cross-construction compatibility matrix.
- [OCR PDF to Structured JSON Bridge](https://elysiatools.com/en/tools/ocr-pdf-to-structured-json-bridge): Extract the PDF text layer with geometry (lines by y-position, tables by column gaps, headings by font size, colon key-value pairs), then fill a user-supplied JSON Schema field by field — labels matched by normalized keys, values coerced to declared types and validated with ajv.
- [OpenTelemetry W3C traceparent / tracestate / baggage + OTLP Header Propagation Validator](https://elysiatools.com/en/tools/opentelemetry-w3c-traceparent-tracestate-baggage-and-otlp-protobuf-headers-propagation-validator): Validate W3C Trace Context propagation headers end to end: traceparent (version / 16-byte trace-id / 8-byte parent-id / trace-flags), tracestate (≤32 list members, tenant keys), baggage (percent-encoded values + opaque properties), OTLP export Content-Type, the gRPC grpc-trace-context-bin 25-byte binary context — plus a two-header correlation round-trip with a random child span-id collision check.
- [PDF Logical Structure Tree WCAG Role Mapping Validator](https://elysiatools.com/en/tools/pdf-logical-structure-tree-validator): Audit a tagged PDF's logical structure tree against PDF/UA-1 (ISO 14289-1) semantics: RoleMap termination, H1-H6 heading hierarchy, Alt text on Figure/Formula, RFC 3066 language tags, illegal nesting, and structure-vs-content MCID reading order — each finding labeled with its Matterhorn Protocol checkpoint.
- [SMT-LIB 2.7 / AIGER / BTOR2 Formal Verification Orchestrator (CDCL + BMC + k-Induction + Craig Interpolation + IC3)](https://elysiatools.com/en/tools/smt-smtlib-2-7-cvc5-z3-btor2-aiger-k-induction-cddr-dbg-invariant-synthesis-orchestrator): A complete in-browser formal-verification stack — no cvc5/Z3 binary needed: an SMT-LIB 2.7 script parser for the QF_BV + Bool core with Tseitin bit-blasting of the FixedSizeBitVectors operators (add/sub/mul/udiv/urem, shifts, comparators, concat/extract/extend, ite), an AIGER reader (ASCII aag and binary aig with delta decoding; outputs as bad properties), a BTOR2 reader with word-level bit-blasting, and a hand-written CDCL SAT engine (two-watched literals, VSIDS-style activities, 1-UIP learning, restarts) underneath. On sequential models it runs bounded model checking with counterexample-witness traces, k-induction with unique-state strengthening, McMillan-style Craig interpolation computed from the refutation and independently re-certified by SAT before being trusted, and an IC3/PDR-lite frame loop with predecessor-cube blocking.
- [Subtitle Platform Spec Checker](https://elysiatools.com/en/tools/subtitle-platform-spec-checker): Validate subtitles against delivery specs: Netflix Timed Text (20/17 CPS reading speed, 42 characters per line, two lines, 5/6-second minimum and 7-second maximum durations, 2-frame gaps), BBC television guidelines (37 characters per line, 160-180 wpm, 1.5-second pause gaps) and YouTube caption rules (plain UTF-8, markup not recognized) — with a per-cue findings report.
- [Train/Test Split with Stratification](https://elysiatools.com/en/tools/train-test-split-with-stratification): Class-stratified train/validation/test split or stratified k-fold for CSV/JSON datasets — seeded, reproducible, with distribution reports, leakage checks, SMOTE preview and CSV export.

## Samples

- [Distributed Tracing Samples](https://elysiatools.com/en/samples/distributed-tracing-samples): Comprehensive distributed tracing examples using Jaeger, OpenTelemetry, and other modern observability tools for microservices architecture
- [Distributed Systems Patterns Samples](https://elysiatools.com/en/samples/distributed-systems): Comprehensive distributed systems patterns covering consistency, consensus algorithms, sharding, and fault tolerance mechanisms
- [Copyright-Free MP3 Audio Samples](https://elysiatools.com/en/samples/mp3-samples): Collection of royalty-free audio samples for testing and development purposes including nature sounds, meditation music, and ambient audio
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion