Computational cryptography › Live on mainnet today › Pairing curves
SIGNATUREPrimitiveROM

BLS signatures

In plain words

Short signatures that can be merged: thousands of validator votes become a single signature.

The idea: Your private key is a secret number a. Your public key is a·G. To sign, hash the message to a curve point and multiply it by a. A pairing lets anyone check the signature against your public key. Because signing is just multiplying by a secret, the votes of thousands of validators on the same block add up into one point, checked with a couple of pairings instead of thousands.

Why it matters: This is what makes proof of stake with hundreds of thousands of validators practical.

The details

On the map: attestations, blocks, sync committees, aggregation, EIP-2537 precompiles

Validators sign blocks, attestations and sync-committee messages with BLS signatures on BLS12-381[1, 2]. Their key property is aggregation: thousands of attestations combine into one signature that can be checked in a single pairing check[3], which is what lets Ethereum run with hundreds of thousands of validators (about 863,000 in October 2026[4], down from nearly a million as Pectra let operators consolidate stake into fewer, larger validators)[5].

Since Pectra (May 2025), contracts can verify BLS signatures directly (EIP-2537 precompiles)[6, 7]. Security rests on co-CDH, with the hash-to-curve function modeled as a random oracle (ROM)[8]. The post-quantum plan replaces BLS with hash-based signatures aggregated by proofs.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

Everything that falls with it (6 boxes)

About the tags

ROM
Its security proof treats a hash function as a perfectly random function (the random oracle model). Real hashes aren't random functions, so this is a heuristic. For signatures and encryption no practical attack has exploited it. For multi-round proof systems, see the Fiat-Shamir box.

References

  1. Ethereum consensus-specs authors. Phase 0: The Beacon Chain (consensus-specs). ethereum/consensus-specs, 2020. github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md
  2. Dan Boneh, Sergey Gorbunov, Riad S. Wahby et al. BLS Signatures (Internet-Draft draft-irtf-cfrg-bls-signature). IRTF CFRG, 2022. datatracker.ietf.org/doc/draft-irtf-cfrg-bls-signature
  3. Dan Boneh, Craig Gentry, Ben Lynn and Hovav Shacham. Aggregate and Verifiably Encrypted Signatures from Bilinear Maps. Advances in Cryptology — EUROCRYPT 2003. doi:10.1007/3-540-39200-9_26
  4. Bitfly. beaconcha.in: Ethereum beacon chain explorer. accessed October 2026. beaconcha.in
  5. mike, Francesco, dapplion et al. EIP-7251: Increase the MAX_EFFECTIVE_BALANCE. Ethereum Improvement Proposals (Final), 2023. eips.ethereum.org/EIPS/eip-7251
  6. Alex Vlasov, Kelly Olson, Alex Stokes and Antonio Sanso. EIP-2537: Precompile for BLS12-381 curve operations. Ethereum Improvement Proposals (Final), 2020. eips.ethereum.org/EIPS/eip-2537
  7. Ethereum Foundation. Pectra Mainnet Announcement. Ethereum Foundation blog, 2025. blog.ethereum.org/en/2025/04/23/pectra-mainnet
  8. A. Faz-Hernandez, S. Scott, N. Sullivan et al. Hashing to Elliptic Curves. RFC 9380, 2023. rfc-editor.org/rfc/rfc9380