BBS+ Signatures

A BBS+ signature is computed over a vector of distinct messages rather than a single payload. This allows an issuer to sign multiple attributes—such as name, age, and nationality—simultaneously within a single cryptographic signature.

• Efficiency: One signature secures an entire credential's attribute set
• Schema Binding: Each message position corresponds to a specific schema-defined claim
• Proof Generation: The holder can later prove knowledge of any subset of these signed messages without revealing the others

The holder of a BBS+ signature can derive a zero-knowledge proof that reveals only a chosen subset of the signed messages while cryptographically hiding the rest. A verifier receives exactly the information they need and nothing more.

• Minimal Data Exposure: Prove age over 21 without revealing birth date
• Unlinkability: Different disclosures from the same credential cannot be correlated
• Predicate Proofs: Support for range proofs and logical conditions on hidden attributes

BBS+ enables the creation of succinct proofs of knowledge of a valid signature without revealing the signature itself or the undisclosed messages. The proof convinces a verifier that the holder possesses a validly issued credential satisfying specific conditions.

• Signature Blinding: The original signature value is never exposed to verifiers
• Proof Non-Interactivity: Proofs are generated without verifier interaction using the Fiat-Shamir heuristic
• Succinctness: Proof size remains compact regardless of the number of hidden attributes

BBS+ signatures are constructed using bilinear pairings over elliptic curves, specifically the BLS12-381 curve. This mathematical foundation enables the signature scheme's unique combination of multi-message signing and zero-knowledge proof capabilities.

• Bilinear Maps: The pairing function e: G1 × G2 → GT enables signature verification across groups
• BLS12-381: The standardized pairing-friendly curve providing 128-bit security
• Type 3 Pairings: Asymmetric pairings used for efficient implementation without loss of security

Each proof derived from a BBS+ signature is cryptographically randomized, ensuring that multiple presentations of the same credential cannot be linked together by a verifier or colluding parties. This prevents tracking and correlation across different interactions.

• Randomized Proofs: Every generated proof is statistically unique
• Domain Separation: Proofs can be bound to specific verifier domains to prevent cross-context replay
• Privacy by Default: Unlinkability is an inherent property, not an optional feature

BBS+ proofs bind the derived zero-knowledge proof to a specific presentation request and the holder's private key. This prevents replay attacks and ensures the presenter is the legitimate holder of the credential, not someone who obtained a copy of the proof.

• Holder Binding: The proof commits to the holder's secret key
• Non-Malleability: Proofs cannot be altered or repurposed for different contexts
• Challenge-Response Integration: Compatible with verifier-issued nonces for freshness guarantees