@solidus-network/bbs

BBS+ selective-disclosure primitives for Solidus Network. Wraps @digitalbazaar/bbs-signatures v3.0.0 with a Solidus-shaped API mirroring solidus-crypto::bbs in the Rust chain crate.

Ciphersuite: BLS12-381-SHA-256 per IRTF draft-irtf-cfrg-bbs-signatures.

Compatibility: byte-compatible with the Solidus chain's BBS+ implementation (zkryptium 0.6.1) for Sign / Verify / ProofGen / ProofVerify, verified by reproducing solidus-crypto::bbs test vectors in this package's vitest suite. The same secret key bytes produce the same public key bytes in both libraries, and signatures generated in one verify in the other.

One known divergence: IKM→SK derivation. zkryptium uses IRTF draft-10 KeyGen, while @digitalbazaar/bbs-signatures 3.0.0 uses an earlier draft. Same IKM → different SK bytes across the two libraries. Practical impact: zero for production (transmit SK bytes directly, or generate randomly). Just don't expect IKM-based keygen to roundtrip across languages.

Audit posture: testnet-grade. External audit pending via NLnet NGI Zero (H2 2026 target). Do not use for production-grade key material until the audit completes.

Install

npm install @solidus-network/bbs

Published on npm as @solidus-network/bbs (the public scope).

Usage

import {
  BbsSecretKey,
  BbsPublicKey,
  BbsSignature,
  utf8,
} from '@solidus-network/bbs'

// Issuer side
const sk = await BbsSecretKey.generate()
const pk = await sk.publicKey()
const header = utf8('did:solidus:testnet:<issuer-1>')
const messages = [
  utf8('did:solidus:testnet:<alice>'),
  utf8('Alice Liddell'),
  utf8('1990-07-04'),
  utf8('GB'),
]
const sig = await sk.sign(header, messages)

// Verifier side
const valid = await sig.verify(pk, header, messages)

// Selective disclosure (holder side)
const proof = await sig.createProof({
  pk,
  header,
  presentationHeader: utf8('verifier-challenge-nonce'),
  messages,
  disclosedIndices: [0, 3], // reveal DID and country only
})

// Verifier-side proof check
const ok = await proof.verify({
  pk,
  header,
  presentationHeader: utf8('verifier-challenge-nonce'),
  disclosedIndices: [0, 3],
  disclosedMessages: [messages[0], messages[3]],
})

Credential-format v2 helpers (unlinkable presentations)

The helpers behind Solidus's unlinkable KYC presentations (used by @solidus-network/auth's verifier surface — see that package's README for the full relying-party quickstart and the runnable unlinkability demo):

import { buildV2Header, derivePresentationHeader, BBS_CREDENTIAL_V2 } from '@solidus-network/bbs'

// The v2 signing header is CONSTANT per (issuer, credential-type, epoch) —
// no per-credential entropy, so it places a holder in a cohort, never
// identifies one:
const header = buildV2Header('did:solidus:testnet:<issuer>', 'kyc', 2)
// utf8("solidus-bbs-credential:v2:did:solidus:testnet:<issuer>:kyc:2")

// The presentation header binds a proof to ONE verifier challenge
// (length-prefixed domain ‖ nonce, hashed) — replay under any other
// challenge fails cryptographically:
const ph = derivePresentationHeader('rp.example.com', nonce32)

Also exported: benchmarkDevice / decideProofPath (the on-device proof-generation benchmark that routes slow devices to an assist prover) and dispatchProof (the routing itself).

Sizes

| Element | Bytes | |---------|-------| | Secret key (Fr scalar) | 32 | | Public key (compressed BLS12-381 G2) | 96 | | Signature | 80 | | Proof (variable) | depends on undisclosed-message count |

Out of scope

• ZK predicate proofs (e.g., proving age ≥ 18 without revealing DOB) — needs Bulletproofs or Plonk on top of BBS+. Tracked under the Solidus Groth16/Plonk decision date 2026-07-31.
• Blind signing — supported by zkryptium, not yet exposed here.

License

Apache-2.0.