Rapidly verifiable aggregate signatures

A method for aggregating digital signatures, the method comprising:

• an aggregator receiving a set of first data packages from a set of signers, a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer;
• the aggregator verifying the payload signatures to determine whether or not the payloads are correctly signed;
• the aggregator bundling a set of correctly signed payloads into a batch;
• the aggregator obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch;
• the aggregator sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer, the respective proof of inclusion proving that the payload of the respective signer is included in the batch;
• the aggregator receiving a set of third data packages from the set of signers, a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer, the respective second secret key being from a signature scheme supporting aggregatable signatures;
• the aggregator verifying the received batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers;
• the aggregator aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature;
• and
• the aggregator including the aggregated batch digest signature in the batch.