{"id":50454157,"url":"https://github.com/mizcausevic-dev/bls-attestation-broker","last_synced_at":"2026-06-01T01:05:42.467Z","repository":{"id":357458053,"uuid":"1236292932","full_name":"mizcausevic-dev/bls-attestation-broker","owner":"mizcausevic-dev","description":"Multi-signer attestation broker using BLS12-381 aggregate signatures. N signatures collapse into one 96-byte aggregate verifiable in two pairings. Reference impl with textbook BLS; production should use blst.","archived":false,"fork":false,"pushed_at":"2026-05-12T21:38:34.000Z","size":30,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-12T22:28:31.026Z","etag":null,"topics":["agent-governance","aggregate-signature","ai-governance","attestation","bls","bls12-381","cryptography","platform-engineering","rust"],"latest_commit_sha":null,"homepage":"https://github.com/mizcausevic-dev/bls-attestation-broker","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mizcausevic-dev.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-12T05:52:17.000Z","updated_at":"2026-05-12T21:38:38.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/mizcausevic-dev/bls-attestation-broker","commit_stats":null,"previous_names":["mizcausevic-dev/bls-attestation-broker"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/mizcausevic-dev/bls-attestation-broker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mizcausevic-dev%2Fbls-attestation-broker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mizcausevic-dev%2Fbls-attestation-broker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mizcausevic-dev%2Fbls-attestation-broker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mizcausevic-dev%2Fbls-attestation-broker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mizcausevic-dev","download_url":"https://codeload.github.com/mizcausevic-dev/bls-attestation-broker/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mizcausevic-dev%2Fbls-attestation-broker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33755379,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-31T02:00:06.040Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["agent-governance","aggregate-signature","ai-governance","attestation","bls","bls12-381","cryptography","platform-engineering","rust"],"created_at":"2026-06-01T01:05:42.389Z","updated_at":"2026-06-01T01:05:42.460Z","avatar_url":"https://github.com/mizcausevic-dev.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# bls-attestation-broker\n\nMulti-signer attestation broker using **BLS12-381 aggregate signatures**. N attestor signatures collapse into one 96-byte aggregate signature verifiable in two pairings — regardless of how many attestors contributed.\n\nUseful when you have a chain of approvals (tenant + admin + policy bot) and want to attach a single compact proof to the resulting action, rather than concatenating N individual signatures.\n\n## Install\n\n```toml\n[dependencies]\nbls-attestation-broker = \"0.1\"\n```\n\n## Quickstart\n\n```rust\nuse bls_attestation_broker::{AttestationBroker, Attestor};\nuse rand::rngs::OsRng;\n\nlet mut rng = OsRng;\nlet tenant_a = Attestor::generate(\u0026mut rng);\nlet tenant_b = Attestor::generate(\u0026mut rng);\nlet tenant_c = Attestor::generate(\u0026mut rng);\n\nlet message = b\"agent='customer-support-tier-1' tool='ticket-create' approved=2026-05-12\";\n\nlet mut broker = AttestationBroker::new(message);\nbroker.add(\u0026tenant_a);\nbroker.add(\u0026tenant_b);\nbroker.add(\u0026tenant_c);\n\nlet attestation = broker.finalize();\n// attestation.aggregate_signature is 96 bytes for any N attestors\n\nlet signers = [tenant_a.public_key(), tenant_b.public_key(), tenant_c.public_key()];\nassert!(attestation.verify(\u0026signers, message));\n```\n\n## Demo\n\n```bash\ncargo run --release --example demo\n```\n\n```\nmessage (82 bytes): agent='customer-support-tier-1' tool='ticket-create' approved=2026-05-12T05:00:00Z\n\naggregated 3 attestor signatures into one signature\naggregate signature: 96 bytes (af599c9405d4c6de9bf55431c868eea2…)\n\nverification: ACCEPT\nverification with imposter for tenant_b: REJECT (expected)\nverification of tampered message: REJECT (expected)\n```\n\n## Why BLS aggregate?\n\n| | Ed25519 (per-signer) | BLS aggregate |\n|---|---|---|\n| Bytes on the wire for N signers | `64 × N` | **96** |\n| Verifier work | `N` pairing-free verifies | **2 pairings** |\n| Public key compactness | `32 × N` | `48 × N` (or one 48-byte aggregate pk for same-message) |\n\nThe win is the *signature*, not the public keys — for many use cases (audit logs, multi-tenant approvals, certificate co-signing) you save a lot of bytes and a lot of CPU on the verify path.\n\n## Tests\n\nEight integration tests in [`tests/bls.rs`](tests/bls.rs):\n\n- single signer → verify\n- three signers → aggregate → verify\n- one imposter in the signer set → reject\n- tampered message → reject\n- mismatched signer count → reject\n- aggregate is exactly 96 bytes for any N\n- public key is exactly 48 bytes\n- single-signer aggregate round-trips\n\nPlus a doctest in the crate root and the `examples/demo.rs` end-to-end.\n\n## Security note\n\nThis crate implements the **textbook BLS signature scheme**: hash-to-scalar followed by scalar multiplication of the G2 generator. That construction is simpler than a full [RFC 9380](https://www.rfc-editor.org/rfc/rfc9380) hash-to-curve implementation and is **not suitable for production deployments**.\n\nFor production:\n- Use a vetted BLS library: [`blst`](https://github.com/supranational/blst), [`bls-signatures`](https://github.com/filecoin-project/bls-signatures), or [`bls_signatures_rs`](https://crates.io/crates/bls_signatures_rs)\n- Use RFC 9380 hash-to-curve with the recommended domain separation tag\n- Use a proof-of-possession or another rogue-key-attack mitigation when aggregating across mutually-distrusting signers on the same message\n\nThis repository is a reference implementation for prototyping, audits, and teaching. The trade-offs are called out so you don't ship it to mainnet by accident.\n\n## Dependencies\n\n- [`bls12_381`](https://crates.io/crates/bls12_381) `0.8` — the curve\n- [`group`](https://crates.io/crates/group) `0.13` — `Curve` trait\n- [`sha2`](https://crates.io/crates/sha2) `0.10` — message hashing\n- [`rand_core`](https://crates.io/crates/rand_core) `0.6` — key generation\n\n## License\n\nAGPL-3.0.\n\n---\n\n**Connect:** [LinkedIn](https://www.linkedin.com/in/mirzacausevic/) · [Kinetic Gain](https://kineticgain.com) · [Medium](https://medium.com/@mizcausevic/) · [Skills](https://mizcausevic.com/skills/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmizcausevic-dev%2Fbls-attestation-broker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmizcausevic-dev%2Fbls-attestation-broker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmizcausevic-dev%2Fbls-attestation-broker/lists"}