fraunhofer-aisec/libbbs

C implementation of the IRTF BBS Internet Draft

libbbs

Specification-compliant and performant implementation of the bbs signature scheme.

Provides a library libbbs implementing the BLS12381-SHA-256 and BLS12-381-SHAKE-256 cipher suite.

Setup

Prerequisites

Dependencies:

• gmp
• xsltproc (indirect dependency of XKCP Keccak hash library)
• cmake (build only)

mkdir build
cd build
cmake ..

Installation

Within build:

make install

Test

Within build:

make
make test

Benchmark

Within build:

make bench

Benchmark on Apple M1 Pro 2021 16GB:

• 2 messages each of size 64 bytes
• Disclosing first message only
• Runtime averaged over 1000 iterations without warmup

Function	SHA256 (ms)	SHAKE256 (ms)
key generation (SK & PK)	0,174	0,172
sign	1,995	1,888
verify	3,877	3,829
proof generation	3,289	3,220
proof verification	4,532	4,482

libbbs's Issues

Better initialization of relic

We should either add a bbs_init function that initializes the subsystem or a compiler attribute (constructor) that does that when the library is loaded.
Currently, it is not even really documented outside of the tests how to use libbbs correctly.

Add benchmark

We would probably like to test the performance of our primitives:

• bbs_keygen_full
• bbs_sign
• bbs_verify
• bbs_proof_gen
• bbs_proof_verify

While the keygen is trivial, for all the other function we probably want to use fixtures and not cumulatively test the other (previous) functions as well.
I would suggest that we create one binary for each function that is run exactly once (potentially with any necessary fixtures loaded).
Unfortunately the existing tests run multiple fixture from the I-D and do other things.
So, I guess we should create dedicated binaries for this.
The resulting binaries can be benchmarked using hyperfine, for example. E.g.:

$ hyperfine perf_bbs_verify

Eventually, this can become a custom (c)make target (make bench)

Implement SHAKE cipher suite

https://www.ietf.org/archive/id/draft-irtf-cfrg-bbs-signatures-05.html#name-bls12-381-shake-256

Note that these two ciphersuites differ only in the hash-to-curve suites used. The hash-to-curve suites differ in the expand_message variant and underlying hash function.```

Add top level API dev documentation

Breaking Relic API change

Building on main throws fatal error:

src/bbs_util.c:608:10: fatal error: 'relic_tmpl_map.h' file not found
#include <relic_tmpl_map.h>

Reason: Relic PR relic-toolkit/relic#292 changed the pairing+elliptic curve API, especially renaming "relic_tmpl_map.h" to "relic_ep_map_tmpl.h" and changing the TMPL_MAP_SSWU API

Benchmark comparisons

Add comparisons regarding runtime to other implementations of BBS:

• https://github.com/mattrglobal/bbs-signatures
• https://github.com/hyperledger-archives/ursa
• https://github.com/microsoft/bbs-node-reference

Note: mattrglobal seems to be a wrapper around hypterledger bbs library which is EOL since April 2023