BBS+ Signature

The defining capability of BBS+ signatures. A holder of a signed credential can derive a proof that reveals only a subset of attributes while hiding the rest. For example, from a digital driver's license, a prover can disclose only age >= 21 without revealing their name, address, or exact birthdate. The verifier receives cryptographic assurance that the revealed attributes were part of the original signed credential without ever seeing the hidden fields.

BBS+ signs a vector of messages (attributes) simultaneously within a single, compact signature. This is fundamentally different from signing each attribute individually. The scheme produces a signature of constant size regardless of the number of messages signed, making it highly efficient for credentials with many claims. A single BBS+ signature can cover dozens of attributes—name, address, credentials, permissions—while remaining only a few hundred bytes.

Each derived proof is cryptographically unlinkable to other proofs from the same credential. Even if a verifier colludes with the original issuer, they cannot correlate two separate presentations. This prevents tracking and surveillance. A user can prove their professional certification to multiple employers, and none can determine it is the same credential being presented, preserving privacy across sessions.

BBS+ supports proofs about attributes without revealing the attributes themselves. A prover can demonstrate predicates such as:

• age > 18 (range proof)
• expiry_date > today (comparison)
• country_of_origin NOT IN sanctioned_list (set membership) The verifier learns only the truth of the predicate, not the underlying value. This is achieved through efficient zero-knowledge proof techniques integrated into the signature scheme.

A BBS+ proof is constant in size regardless of the number of revealed attributes. Whether disclosing 1 attribute or 50, the proof remains approximately the same length—typically a few hundred bytes. This is a significant advantage over schemes where proof size grows linearly with the number of disclosed attributes, making BBS+ ideal for bandwidth-constrained environments like mobile devices and IoT.

BBS+ is built on bilinear pairings over elliptic curves, specifically the BLS12-381 curve. The security relies on the q-Strong Diffie-Hellman assumption. This mathematical foundation enables the scheme's unique combination of properties: multi-message signing, selective disclosure, and unlinkable proofs. The BLS12-381 curve provides approximately 128-bit security and is widely adopted in standards including W3C Verifiable Credentials and IETF drafts.

A cryptographic method where a prover demonstrates knowledge of a secret without revealing the secret itself. BBS+ signatures are a specific type of ZKP-friendly signature scheme.

• Proof of knowledge: The verifier learns nothing beyond the validity of the disclosed attributes
• Unlinkability: Multiple presentations of the same credential cannot be correlated
• BBS+ proofs are significantly shorter and faster to verify than general-purpose ZK-SNARKs for credential use cases

The mathematical foundation enabling BBS+ signatures, built on bilinear pairings over elliptic curves. The BLS12-381 curve is the standard choice.

• A pairing operation e(aP, bQ) = e(P, Q)^(ab) enables signature aggregation and proof generation
• BBS+ security relies on the q-Strong Diffie-Hellman assumption
• Pairing-based constructions allow a single multi-message signature to be split into proofs about individual messages

Cryptographic evidence preventing an entity from denying its involvement in an action. In AI governance, a BBS+ signature on an audit entry serves as a non-repudiation token.

• An auditor can selectively disclose which model version and inference timestamp were signed without revealing proprietary input data
• The signature binds the signer's identity to the specific audit event
• Enables privacy-preserving accountability in regulated AI decision logs

A cryptographic fingerprint generated from the inputs, outputs, and version of an AI model during inference. BBS+ signatures can sign these hashes to create verifiable, selectively disclosable audit records.

• A signed inference hash proves a specific model produced a specific output at a specific time
• Selective disclosure allows revealing the model version while keeping the input data confidential
• Creates an immutable chain of custody for AI decisions without exposing sensitive business logic