BLS Boneh–Lynn–Shacham Threshold Signature Aggregation + Distributed Key Generation Simulator

An educational simulator for the BLS signature scheme (Boneh–Lynn–Shacham 2001, standardized in draft-irtf-cfrg-bls-signature-04) — the scheme behind Ethereum 2 beacon-chain attestations, Chia, Polkadot and Filecoin.

The scalar field is the real BLS12-381 subgroup order r, so secret keys, Shamir shares, Lagrange coefficients and rogue-key cancellations use the exact production modulus. The group is a didactic prime-order multiplicative group with the abstract pairing e(g^a, g^b) = g^(ab): every bilinear identity BLS relies on (σ = H(m)^sk verifying as e(σ, g) = e(H(m), g^sk)) is preserved; elliptic-curve and hash-to-curve (SSWU) arithmetic is not exercised.

Scenarios:

1. Joint-Feldman DKG — every participant deals a random degree-(t−1) polynomial, publishes Feldman commitments Ci,k = g^{ai,k} (plus optional Pedersen hiding commitments), and privately distributes shares. Share checks expose crooked dealers; the group public key Π Ci,0 equals g^{group secret} although the secret never materializes. Then t-of-n threshold signing: partials σi = H(m)^{s_i} combine via Lagrange coefficients into a signature identical to the full signer’s; sub-threshold quorums are rejected.

2. Rogue-key attack — an attacker publishes pk* = g^α·Πpkᵢ⁻¹ (computable from public keys alone) and forges an aggregate signature that plain verification accepts. The proof-of-possession defense (PopProve = sign the hash of your own public key) rejects the rogue key at registration.

3. Ethereum 2 attestation aggregation — n validators sign the same attestation data; σ_agg = Πσᵢ stays 96 bytes and FastAggregateVerify costs 2 pairings regardless of n; the ⅔ quorum sub-aggregate verifies incrementally.

All runs are deterministic given the seed text, so ceremonies replay identically.