---
title: 'BBS+ Signatures: Efficient Privacy-Preserving Credentials'
url: https://www.emergentmind.com/topics/bbs-signatures
type: topic
---

# BBS+ Signatures: Efficient Privacy-Preserving Credentials

BBS+ signatures are pairing-based cryptographic primitives enabling compact, efficient multi-attribute credentials with native support for privacy-preserving selective disclosure. Designed for verifiable credentials, the BBS+ scheme permits a credential holder to prove possession of a valid signature and certify revealed attributes without disclosing the complete signed message set. The cryptographic foundations rely on bilinear pairings and discrete log hardness, providing efficient protocols for credential issuance, verification, and non-interactive zero-knowledge proofs facilitating selective attribute release. BBS+ is established as a reference mechanism for digital credentials in privacy-oriented standards and open-source implementations, balancing unlinkability, performance, and cryptographic agility, but is not quantum-resistant [2401.08196].

## 1. Algebraic Foundations and Key Generation

BBS+ signatures operate over three cyclic groups of prime order $p$: $\mathbb{G}_1 = \langle g_1 \rangle$, $\mathbb{G}_2 = \langle g_2 \rangle$, and $\mathbb{G}_T$, equipped with an efficient, non-degenerate bilinear pairing
\[
\mathbf{e}: \mathbb{G}_1 \times \mathbb{G}_2 \longrightarrow \mathbb{G}_T,
\]
satisfying bilinearity $\mathbf{e}(g_1^a, g_2^b) = \mathbf{e}(g_1, g_2)^{ab}$ and polynomial-time computability. Public parameters are fixed as $\mathsf{pp} = (p, \mathbb{G}_1, g_1, \mathbb{G}_2, g_2, \mathbb{G}_T, \mathbf{e}, h_0, \ldots, h_m)$, where $h_0, \ldots, h_m$ are random generators in $\mathbb{G}_1$.

Key generation proceeds by sampling a secret key $x \leftarrow \mathbb{Z}_p^*$ and setting the public key as $w = g_2^x \in \mathbb{G}_2$, such that $\mathsf{SK} = x$ and $\mathsf{PK} = (w, h_0, \ldots, h_m)$ [2401.08196].

## 2. Signature Generation and Verification

Given messages (or attributes) $a_1, \ldots, a_m \in \mathbb{Z}_p$, signing involves the following steps:
1. Sample randomness $e, s \leftarrow \mathbb{Z}_p$.
2. Compute the commitment
   \[
   C = g_1\,h_0^s\,\prod_{i=1}^m h_i^{a_i} \in \mathbb{G}_1.
   \]
3. Calculate
   \[
   A = C^{1/(x+e)} \quad \text{(with the inverse taken modulo $p$)}.
   \]
4. Output the signature $\sigma = (A, e, s) \in \mathbb{G}_1 \times \mathbb{Z}_p \times \mathbb{Z}_p$.

Verification, given $\sigma = (A, e, s)$ and the (revealed) attributes, uses the equation:
\[
\mathbf{e}\bigl(A,\,w\,g_2^{e}\bigr) \stackrel{?}{=} \mathbf{e}\Bigl(g_1\,h_0^s\,\prod_{i=1}^m h_i^{a_i},\,g_2\Bigr),
\]
accepting if the equation is satisfied and $A \neq 1$.

## 3. Selective Disclosure via Non-Interactive Proofs of Knowledge

Selective disclosure allows a holder to reveal a subset $\mathcal{D} \subseteq \{1,\ldots,m\}$ of signed attributes while proving the signature’s validity on the whole set. The holder generates a non-interactive zero-knowledge proof (NIZKP) of knowledge of a BBS+ signature using the Fiat–Shamir transform with a Sigma protocol for linear relations.

Key steps:
- The presentation proof involves re-randomizing signature elements (using fresh randomizers $r_1, r_2$), constructing commitments, and deriving a Fiat–Shamir challenge.
- The proof convinces the verifier that all disclosed attributes are certified, and that hidden attributes complete the original signature, without leaking any additional information.
- Verification recomputes the challenge and checks pairing and commitment equations. Successful verification confirms knowledge of a valid BBS+ signature on all $m$ attributes, with only the $\mathcal{D}$ disclosed.

This property makes BBS+ signatures suitable for privacy-preserving credential presentations in eID systems and digital wallets [2401.08196].

## 4. Security Assumptions and Privacy Guarantees

Security of BBS+ signatures is based on discrete log and pairing hardness assumptions:
- **Unforgeability** reduces to the q-Strong Diffie–Hellman (q-SDH) problem in $\mathbb{G}_1$.
- **Zero-knowledge** is ensured in the honest-verifier setting under the random-oracle model, due to the simulability of the Fiat–Shamir transformed Sigma protocol.
- **Unlinkability** arises from signature and proof randomization: each selective disclosure presentation is statistically independent due to the fresh choice of randomizers, precluding correlation across distinct presentations.
- **Quantum resistance:** BBS+ signatures, relying on discrete logarithm assumptions, are not quantum-safe. Several lattice-based constructions (such as by Jeudy–Sanders and Bootle–Sanders) aim to address this but remain works in progress without standardization [2401.08196].

## 5. Performance Characteristics and Implementation Trade-Offs

Empirical benchmarks targeting 128-bit security (using the BLS12-381 pairing-friendly curve and SHA-256) indicate:

| Object                        | Size            | Computation Time (AMD Ryzen 7 5800X) |
|-------------------------------|-----------------|--------------------------------------|
| BBS+ signature ($\sigma$)     | 112 bytes       | ~1 ms for issuance                   |
| Presentation proof            | $240\!-\!1424$ B (33 attributes) | 1.65 ms (generation), 2.14 ms (verification) |

- Proof size scales with the number of hidden attributes, i.e., $n_A-n_D$, so disclosing more attributes reduces bandwidth and CPU cost.
- Cost is linear in the number of hidden attributes.
- Threshold-issuance variants are supported, preserving existing proof and verification APIs.
- A trade-off exists between instantiating the scheme in $\mathbb{G}_1$ versus $\mathbb{G}_2$: $\mathbb{G}_1$ operations are cheaper and keys smaller.
- Sub-millisecond issuance and few-millisecond proof operations enable practical deployments in resource-constrained environments such as mobile devices [2401.08196].

## 6. Comparisons, Applications, and Standardization

BBS+ signatures represent one of two principal classes of selective disclosure mechanisms for verifiable credentials, the other based on hiding commitments (e.g., mdl ISO/IEC 18013-5). BBS+ excels at supporting unlinkable, multi-attribute presentations with predicate proofs and admits threshold-issuance variants while maintaining strong privacy guarantees.

BBS+ has seen adoption in open-source Rust implementations, empirical studies, and regulatory-driven deployments such as eIDAS2 digital identity frameworks. Its efficiency, flexibility for selective disclosure, and unlinkability have driven its use as a reference construction in privacy-preserving verifiable credential standards. The lack of quantum resistance remains a research focus, with emerging but as-yet non-standardized lattice-based alternatives [2401.08196].

Source: https://www.emergentmind.com/topics/bbs-signatures