Skip to content

basic_bls_signing

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

basic_bls_signing

Folders and files

README.md

Threshold BLS Signatures (Rust)

The Basic BLS signing example demonstrates how to use VetKeys to implement a threshold BLS signing service on the Internet Computer (IC), where every authenticated user can ask the canister to produce signatures, with the Internet Identity Principal identifying the signer. The canister ensures a user can only produce signatures for their own principal, not for someone else's. Furthermore, the vetKeys in this app can only be produced upon a user request, as specified in the canister code — the canister cannot produce signatures for arbitrary users or messages.

To confirm the canister can only produce signatures in the intended way, users need to inspect the code installed in the canister. For this, it is crucial that canisters using VetKeys have their code public.

UI Screenshot

Features

  • Signer Authorization: Only authorized users can produce signatures, and only for their own identity.
  • Frontend Signature Verification: Any user can publish a signature from their principal in the canister storage, and the frontend automatically checks its validity.

Build and deploy from the command line

Prerequisites

  • Install Node.js
  • Install icp-cli: npm install -g @icp-sdk/icp-cli @icp-sdk/ic-wasm
  • Install the Rust toolchain, then add the WASM target: rustup target add wasm32-unknown-unknown

(Optionally) choose a different master key

This example uses test_key_1 by default. To use a different available master key, change the init_args value in icp.yaml before deploying.

Install

git clone https://github.com/dfinity/examples
cd examples/rust/vetkeys/basic_bls_signing

Deploy

icp network start -d
icp deploy

Internet Identity sign-in runs against the Internet Identity canister deployed on the local network (ii: true in icp.yaml). If signing in fails, update the local network launcher with icp network update and restart the network.

Open the frontend URL printed by icp deploy.

To run the frontend in development mode with hot reloading (after icp deploy):

npm run dev

When done, stop the local network to free up the port for other projects:

icp network stop

Example components

Backend (backend/)

A single Rust canister that:

  • Produces BLS signatures upon a user request.
  • Lets users retrieve the public key used to verify their signatures.
  • Lets users store signatures (real or fake) in a log data structure.

Frontend (frontend/)

A vanilla TypeScript application providing a simple interface for signing, showing the signatures stored in the canister, and verifying a signature. Canister bindings are generated from backend/backend.did at build time by the @icp-sdk/bindgen Vite plugin.

Updating the Candid interface

backend/backend.did defines the backend's public interface; the frontend bindings are generated from it during the build. If you change the backend's public API, regenerate it:

icp build backend && candid-extractor target/wasm32-unknown-unknown/release/backend.wasm > backend/backend.did

Additional resources