Hi everyone,
I’d like to share some recent research on drastically reducing the computational overhead of public key obfuscation for BLS signatures.
While the raw storage of BLS12 public keys is great for signature aggregation, it exposes validators to linkability and subgroup membership leakage. Obfuscating these keys into uniform random bitstrings via the Elligator Squared framework is cryptographically sound, but typically introduces a heavy latency penalty due to costly inverse isogeny maps and full-scalar cofactor blinding/clearing.
We have developed an optimized obfuscation and deobfuscation pipeline that practically eliminates this field-scaling penalty. By utilizing steganographically engineered curve variants (BLS12-479+ and BLS12-539+) that natively support a computational 2-isogeny bridge, we establish a strict birational equivalence to the Extended Jacobi Quartic space.
Key Architectural Optimizations:
-
Inversion-Free Arithmetic: By fusing Billet-Joye birational mappings with Hişil’s homogeneous projective coordinates P(1,1,1), we completely eliminate intermediate field inversions. The pipeline defers the solitary field inversion to the final affine projection at the absolute end of the deobfuscation cycle.
-
Jacobi Quartic Sandbox: Heavy scalar multiplications are executed entirely within the accelerated Jacobi space using an ultra-fast dedicated doubling formula (3M+4S+1C+3add).
-
Asymmetric wNAFwNAF with Batch-Normalized Tables: We employ a wide window (w=5) for full-scalar blinding and a minimal window (w=2) for the receiver’s Fast Cofactor Clearing (∣1−z∣ scalar).Precomputation tables are normalized (Z=1) using Montgomery Batch Inversion, allowing the main evaluation loop to exclusively execute dedicated addition formulas (9M+5S+1C+6add).
Empirical Results (100,000 Deterministic Iterations on Magma V2.29-6):
Our user-level interpreted prototype completely absorbs the field-scaling penalty, outperforming the pre-compiled C-library baseline for standard BLS12-381:
-
BLS12-381 (Native C-compiled baseline): 26.43M cycles (Obfuscation) | 2.66M cycles (Deobfuscation)
-
BLS12-479+ (Interpreted Jacobi): 21.08M cycles (Obfuscation, 20.2% faster) | 2.63M cycles (Deobfuscation)
-
BLS12-539+ (Interpreted Jacobi): 25.75M cycles (Obfuscation, 2.5% faster) | 3.06M cycles (Deobfuscation)
To rigorously isolate the algorithmic density from the interpreter’s overhead, we also ran a targeted microbenchmark on the pure scalar multiplication loop. Magma’s native, C-compiled intrinsic for the Weierstrass curve executed in 11.57M cycles. In contrast, our fully interpreted Jacobi $w\text{NAF}$ script completed the same operation in 15.60M cycles. Achieving a latency ratio of just 134.8% against a heavily optimized native C core mathematically validates the profound efficiency of the $9\mathbf{M}+5\mathbf{S}$ Jacobi arithmetic.
Given that our interpreted Magma script already operates below the pre-compiled 381-bit baseline despite virtual machine dispatch overheads, we project that a compiled C/Rust implementation—stripping away this 34.8% interpreter gap and leveraging Thread/Instruction-Level Parallelism—will comfortably shatter native thresholds for production consensus clients.
Feedback, questions, and thoughts—especially regarding potential Rust/C reference implementations for validator nodes—are highly welcome!