Threshold signatures

Witness currently supports two per-network signature representations.

Ed25519 multi-signature

Ed25519 is the default. The signed attestation contains one 64-byte signature record for each participating witness, together with its witness ID. The verifier looks up each ID in the secret-free network configuration, verifies the signature over Attestation::to_bytes(), rejects duplicate IDs, and requires the configured threshold.

This is a multi-signature representation: signatures remain individually visible. It is not a single cryptographic threshold signature.

BLS12-381 aggregate

BLS mode uses blst::min_sig. Each witness signs the same attestation and the gateway aggregates the signature bytes into one 48-byte compressed G1 signature (the configured BLS public keys are 96-byte compressed G2 keys). The wire object also carries the signer IDs. Verification aggregates the corresponding public keys and checks the aggregate, after enforcing unique known signers and the configured threshold. The current verifier does not check proof-of-possession (PoP) for BLS keys.

The compact signature is useful when many witnesses participate. The repository describes a 75% signature-byte saving versus three 64-byte Ed25519 signatures.

Implemented behavior

The gateway supports both schemes for attestations and Signed Tree Heads, and the same core verification rules are used by the gateway, CLI, and auditor. The signature representation must agree with signature_scheme; a mismatch is rejected. The JSON union rejects ambiguous or partial multi-sig/BLS shapes.

Assumptions

The public key set and signer IDs are authentic and stable for the verification operation. A BLS deployment therefore requires a trusted membership-key registration process that authenticates each witness/key binding and requires PoP before admitting the key to the verification configuration. Under that assumption, BLS aggregate verification proves the registered public keys jointly validate the aggregate; the threshold policy supplies the minimum signer-list count. Without the trusted registration/PoP assumption, a listed set of distinct IDs is not, by itself, proof that that many distinct witnesses participated.

Non-goals

Witness does not currently describe a DKG, secret-sharing ceremony, or native single-key threshold-signature protocol. BLS aggregation does not by itself remove the need to trust the signer list, public-key configuration, the membership registration/PoP process, or the operator threshold policy.

TODO — maintainer review

Have a cryptography maintainer review the BLS terminology, aggregate security assumptions, and the byte-size comparison before this page is treated as a protocol guarantee.