BLS12-381 aggregate signature verification support #8184

karim-en · 2022-12-07T23:53:57Z

BLS12-381 aggregate signature verification support

Motivation

For proper work of the Rainbow Bridge, the ETH2 Light Client should be implemented as a NEAR contract. Inside the ETH2 Light Client, it is necessary to verify BLS12-381 signatures. At the moment, there are no practical implementations of BLS signatures that (1) have been audited, (2) could be compiled into a wasm file, and (3) would fit into the gas limit.

Because of this, at the moment, verification of BLS signatures in the Rainbow Bridge is performed out-of-chain, which makes it not trustless, as we would like. This pull request is dedicated to adding the ability to verify the correctness of the aggregated BLS12-381 signature to the NEAR level, which will allow us to further verify ETH2 data completely on NEAR and make Rainbow Bridge trustless.

Main changes

Added bls12_381_aggregate_verify function into runtime/near-vm-logic/src/logic.rs. This function verifies the aggregate bls12-381 signature for a given message and public keys list (or one aggregate public key).
Tests for bls-signature verification
Gas estimation for bls-signature verification

Library

For implementation, we use the blst library(https://github.com/supranational/blst). This library was audited and shows good performance, but can't be used directly in the smart contracts.

Gas estimation

We have two changeable parameters: message len and public keys count. For verification, we first aggregate keys and only after verifying the signature, so the message length and public keys number influence gas consumption independently.

For gas estimation we have 3 parameters:

bls12381_verify_base -- the basic gas consumption
bls12381_verify_byte -- the extra gas consumption for each extra message byte
bls12381_verify_elements -- the extra gas consumption for each extra public key

The resulting formula for gas estimation:

input_cost(aggregate_signature_len) + input_cost(msg_len) + input_cost(pubkeys_len) + bls12381_verify_base + bls12381_verify_byte * msg_len + bls12381_verify_elements * pubkeys_cnt

For the gas estimation we have 3 functions:

bls12_381_verify_basic_100 -- for calculation bls12381_verify_base verify signature for short message signed by one key.
bls12_381_verify_bytes_10k_100 -- for calculation bls12381_verify_byte verify signature for a long message with one key
bls12_381_verify_elements_1000_10 -- for calculation bls12381_verify_elements verify the signature for a short message with a lot of public keys.
bls12381_verify_base = 2_478_509_560_740
bls12381_verify_byte = 253_238_393
bls12381_verify_elements = 111_561_061_580

In our case, we have a 32-bytes message with 512 public keys and the gas consumption is approximately = 60 * 10**12 (with the safe constant ~180 * 10**12). The MAX_GAS = 300 * 10**12

* Minor code improvments * Improve blst code estimation * Apply cargo fmt

akhi3030 · 2022-12-09T10:40:59Z

CC: @jakmeier; @Ekleog-NEAR; @nagisa.

nagisa · 2022-12-09T11:56:15Z

Adding host functions of this sort has required a NEP in the past (for example NEP-364 was necessary to add a ed25519_verify host function). Has one such been accepted for these functions yet?

akhi3030 · 2022-12-09T12:15:02Z

Adding host functions of this sort has required a NEP in the past (for example NEP-364 was necessary to add a ed25519_verify host function). Has one such been accepted for these functions yet?

Good point. @karim-en: please see https://github.com/near/NEPs/blob/master/neps/nep-0001.md for more information on the NEP process and of course the example above.

blasrodri · 2023-01-25T23:43:21Z

runtime/near-vm-logic/src/tests/bls12_381_verify.rs

+#[test]
+fn test_bls12_381_verify_valid() {
+    let hex_convert_error_msg = "Error during converting hex string to bytes";
+    let signature: Vec<u8> = <Vec<u8>>::from_hex("912c3615f69575407db9392eb21fee18fff797eeb2fbe1816366ca2a08ae574d8824dbfafb4c9eaa1cf61b63c6f9b69911f269b664c42947dd1b53ef1081926c1e82bb2a465f927124b08391a5249036146d6f3f1e17ff5f162f779746d830d1").expect(hex_convert_error_msg);


would be nice to have a reference, or a way to reproduce these {signatures, pubkeys, ...}. In Aptos I've seen that they attach a python script.

fixed: 8a083a2

blasrodri · 2023-01-25T23:45:00Z

runtime/near-vm-logic/src/tests/bls12_381_verify.rs

+    let message: Vec<u8> =
+        <Vec<u8>>::from_hex("abababababababababababababababababababababababababababababababab")
+            .expect(hex_convert_error_msg);
+    let pubkeys_raw: Vec<Vec<u8>> = vec![


[nit]
aren't types inferred by the compiler?

fixed: aded51a

blasrodri · 2023-01-25T23:45:55Z

runtime/near-vm-logic/src/logic.rs

+    /// Verify aggregate BLS12-381 signature for given message and
+    /// public keys list (or one aggregate public key)
+    ///
+    /// The length of each public key(include aggregate one) should be 48 bytes and


Suggested change

/// The length of each public key(include aggregate one) should be 48 bytes and

/// The length of each public key (including the aggregated one) should be 48 bytes and

fixed: 89051f9

blasrodri · 2023-01-25T23:48:40Z

runtime/near-vm-logic/src/logic.rs

+            self.get_vec_from_memory_or_register(aggregate_signature_ptr, aggregate_signature_len)?;
+        let message = self.get_vec_from_memory_or_register(msg_ptr, msg_len)?;
+        let pubkeys_raw = self.get_vec_from_memory_or_register(pubkeys_ptr, pubkeys_len)?;
+        let num_pubkeys = (pubkeys_raw.len() as u64) / PUBKEY_LEN;


is there a need to add a check in case pubkeys raw length isn't a multiple of PUBKEY_LEN?

fixed: 6355c63

olga24912 · 2023-02-01T11:21:39Z

@blasrodri thank you for your comments and for finding time for reviewing this PR :)

mm-near

overall PR looks good.

one 'meta' thing - is to add the compiler flag & re-sync to the current HEAD.

Next step - please prepare the NEP (and mention it in this PR)

mm-near · 2023-02-09T15:11:55Z

runtime/near-test-contracts/estimator-contract/src/lib.rs

@@ -62,6 +62,15 @@ extern "C" {
        pub_key_len: u64,
        pub_key_ptr: u64,
    ) -> u64;
+
+    fn bls12_381_aggregate_verify(


new features have to be 'cfg' protected (look at how the protocol_feature_ed25519_verify looks like)

mm-near · 2023-02-09T15:15:56Z

runtime/near-vm-logic/src/logic.rs

+        self.gas_counter.pay_base(bls12381_verify_base)?;
+        const PUBKEY_LEN: usize = 48;
+
+        let aggregate_signature =


shouldn't you check that aggregate_signature.len() is equal to 96 here?

mm-near · 2023-02-09T15:25:11Z

runtime/near-vm-logic/src/logic.rs

+        self.gas_counter.pay_per(bls12381_verify_byte, message.len() as u64)?;
+        self.gas_counter.pay_per(bls12381_verify_elements, num_pubkeys as u64)?;
+
+        let aggregate_sig = match blst::min_pk::Signature::sig_validate(&aggregate_signature, false)


add comment explaining why you set sig_infcheck to false

mm-near · 2023-02-09T15:33:08Z

runtime/near-vm-logic/src/logic.rs

+            Vec::with_capacity(num_pubkeys.try_into().unwrap());
+
+        for i in 0..num_pubkeys {
+            pubkeys.push(


nit: a little bit more rusty approach would be:

let pubkeys = pubkeys_raw.chunks(PUBKEY_LEN).map(|key| {...}).collect();

mm-near · 2023-02-09T15:43:15Z

runtime/near-vm-logic/src/logic.rs

+        let res = aggregate_sig.fast_aggregate_verify(
+            true,
+            &message,
+            b"BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_",


please add more explanation on where this magic string comes from.

mm-near · 2023-02-09T15:44:19Z

runtime/near-vm-logic/src/logic.rs

+        }
+
+        let res = aggregate_sig.fast_aggregate_verify(
+            true,


mention what does the first variable do - and why do we set it to true.

mm-near · 2023-02-09T15:48:59Z

runtime/near-vm-logic/src/logic.rs

+            return Err(VMLogicError::from(Bls1238VerifyError(Bls12381Error::IncorrectPubKeysLen)));
+        }
+
+        let num_pubkeys = pubkeys_raw.len() / PUBKEY_LEN;


can you also add a test what happens when pubkeys_raw.len is 0?

mm-near · 2023-02-09T15:49:24Z

runtime/near-vm-logic/src/logic.rs

+
+        let aggregate_signature =
+            self.get_vec_from_memory_or_register(aggregate_signature_ptr, aggregate_signature_len)?;
+        let message = self.get_vec_from_memory_or_register(msg_ptr, msg_len)?;


what happens if message is empty? (can you add a test?)

akhi3030 · 2023-11-03T16:53:14Z

I think this is not being actively worked on.

olga24912 and others added 21 commits November 1, 2022 18:47

check bls signature

f643dfe

change function name

24a9876

fmt

3453cf6

verify aggregate bls signature

79ad759

verify bls signature cost

fa707a2

cost estimation

d80d9d6

add test for bls verification

f711d10

bls verify tests

2756c6f

don't panic during bls verification

2b7f153

test aggregate bls

82f3c45

comment for a new function

c854964

add the comment about test origin

6eaf124

blst errors

9383166

errors from BLST_ERRORS

86b53bc

Merge remote-tracking branch 'upstream/master' into bls-sig

4af1e91

Data Array len

a2af641

Merge remote-tracking branch 'upstream/master' into bls-sig

3541889

fix comment

4a730f2

add flag for blst lib during gas estimation

a0379ce

Merge remote-tracking branch 'upstream/master' into bls-sig

320fce3

BLS improvments (#2)

3e99038

* Minor code improvments * Improve blst code estimation * Apply cargo fmt

karim-en requested a review from a team as a code owner December 7, 2022 23:53

karim-en requested a review from mm-near December 7, 2022 23:53

karim-en marked this pull request as draft December 8, 2022 00:00

karim-en added 3 commits December 8, 2022 00:08

Merge remote-tracking branch 'near/master' into bls12-381-support

a257852

Fix bls12381 costs after merge

00e4371

Apply cargo fmt

15717a2

karim-en marked this pull request as ready for review December 9, 2022 00:54

akhi3030 added A-contract-runtime Area: contract compilation and execution, virtual machines, etc T-contract-runtime Team: issues relevant to the contract runtime team labels Dec 9, 2022

akhi3030 added the A-params-estimator Area: runtime params estimator label Dec 9, 2022

mfornet mentioned this pull request Dec 26, 2022

NEP-446: Efficient BLS-signature verification near/NEPs#446

Closed

blasrodri reviewed Jan 25, 2023

View reviewed changes

olga24912 added 4 commits February 1, 2023 12:17

add extra information about tests data

8a083a2

remove redundant types

aded51a

fix comment

89051f9

check pubkeys len

6355c63

fix typo

62365f8

mm-near reviewed Feb 9, 2023

View reviewed changes

akhi3030 closed this Nov 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BLS12-381 aggregate signature verification support #8184

BLS12-381 aggregate signature verification support #8184

karim-en commented Dec 7, 2022 •

edited

Loading

akhi3030 commented Dec 9, 2022

nagisa commented Dec 9, 2022

akhi3030 commented Dec 9, 2022

blasrodri Jan 25, 2023 •

edited

Loading

olga24912 Feb 1, 2023

blasrodri Jan 25, 2023

olga24912 Feb 1, 2023

blasrodri Jan 25, 2023

olga24912 Feb 1, 2023

blasrodri Jan 25, 2023

olga24912 Feb 1, 2023

olga24912 commented Feb 1, 2023

mm-near left a comment

mm-near Feb 9, 2023

mm-near Feb 9, 2023

mm-near Feb 9, 2023

mm-near Feb 9, 2023

mm-near Feb 9, 2023

mm-near Feb 9, 2023

mm-near Feb 9, 2023

mm-near Feb 9, 2023

akhi3030 commented Nov 3, 2023

	/// The length of each public key(include aggregate one) should be 48 bytes and
	/// The length of each public key (including the aggregated one) should be 48 bytes and

BLS12-381 aggregate signature verification support #8184

BLS12-381 aggregate signature verification support #8184

Conversation

karim-en commented Dec 7, 2022 • edited Loading

BLS12-381 aggregate signature verification support

Motivation

Main changes

Library

Gas estimation

akhi3030 commented Dec 9, 2022

nagisa commented Dec 9, 2022

akhi3030 commented Dec 9, 2022

blasrodri Jan 25, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

olga24912 commented Feb 1, 2023

mm-near left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

akhi3030 commented Nov 3, 2023

karim-en commented Dec 7, 2022 •

edited

Loading

blasrodri Jan 25, 2023 •

edited

Loading