# US 2026/0100848 A1 · Rapidly verifiable aggregate signatures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100848 A1 - Document ID: US20260100848A1 - Status: Published application - Kind: A1 - Application number: 19/114,055 - Filed: 2023-08-28 - Published: 2026-04-09 - Earliest claimed: 2022-09-23 - Assignees: Ecole Polytechnique Federale De Lausanne (Epfl) - Applicants: Ecole Polytechnique Federale De Lausanne (Epfl) - Inventors: Martina CAMAIONI; Rachid GUERRAOUI; Matteo MONTI; Pierre-Louis ROMAN; Manuel VIDIGUEIRA; Gauthier VORON - Web page: https://patentgrep.com/patent/US20260100848A1 ## CPC - G06F 21/645: {using a third party} - H04L 9/3247: {involving digital signatures} - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for aggregating digital signatures includes receiving first data packages from signers, each first data package including a signer identifier, a payload, and a payload signature; verifying the payload signatures; bundling correctly signed payloads into a batch; obtaining a batch digest, and proofs of inclusion of the payloads in the batch. In some embodiments, the method further includes sending second data packages including the batch digest and a respective proof of inclusion to the signers, the respective proof of inclusion proving that the payload of the respective signer is included in the batch; receiving third data packages from the signers, each third data package including the signer identifier, and a respective batch digest signature. The method may additionally include verifying the batch digest signatures; aggregating correctly signed batch digest signatures; and including the aggregated batch digest signature in the batch. ## Claims ### Claim 1 A method for aggregating digital signatures, the method comprising: an aggregator receiving a set of first data packages from a set of signers, a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer; the aggregator verifying the payload signatures to determine whether or not the payloads are correctly signed; the aggregator bundling a set of correctly signed payloads into a batch; the aggregator obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch; the aggregator sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer, the respective proof of inclusion proving that the payload of the respective signer is included in the batch; the aggregator receiving a set of third data packages from the set of signers, a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer, the respective second secret key being from a signature scheme supporting aggregatable signatures; the aggregator verifying the received batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers; the aggregator aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature; and the aggregator including the aggregated batch digest signature in the batch. ### Claim 2 (depends on 1) The method according to claim 1, wherein the method further comprises the aggregator sending a respective fourth data package to one or more verifiers, the respective fourth data package comprising the batch comprising the set of the correctly signed payloads, the aggregated batch digest signature, and the signer identifiers of the signers whose payload is in the batch. ### Claim 3 (depends on 2) The method according to claim 2, wherein the respective fourth data package further comprises the payload signatures from the signers whose batch digest signature was not received by the aggregator within a given time window. ### Claim 4 (depends on 1) The method according to claim 1, wherein in response to the respective signer receiving the respective second data package, the method further comprises the respective signer verifying that the payload of the respective signer matches the received proof of inclusion, and that the received batch digest also matches the received proof of inclusion. ### Claim 5 (depends on 1) The method according to claim 1, wherein the number of the obtained proofs of inclusion equals the number of the payloads in the batch, and/or wherein the batch comprises at most one payload per signer. ### Claim 6 (depends on 1) The method according to claim 1, wherein the method comprises computing a cryptographic commitment of the batch to obtain the batch digest. ### Claim 7 (depends on 6) The method according to claim 6, wherein the cryptographic commitment of the batch is computed by using a Merkle tree, and the batch digest is a root of the Merkle tree. ### Claim 8 (depends on 1) The method according to claim 1, wherein prior to aggregating the set of correctly signed batch digest signatures, the method comprises replacing the corresponding payload signatures with the correctly signed batch digest signatures received by the aggregator within a given time window. ### Claim 9 (depends on 1) The method according to claim 1, wherein the second secret keys are BLS secret keys, and/or wherein the first and second secret keys are secret keys from different cryptographic signature schemes, or the first and second secret keys are secret keys from the same cryptographic signature scheme, and/or the respective first secret key is the same as the respective second secret key. ### Claim 10 (depends on 1) The method according to claim 1, wherein the aggregator is an untrusted entity, and/or wherein the method involves a plurality of aggregators such that the plurality of aggregators exchange the data packages with the respective signer. ### Claim 11 (depends on 1) The method according to claim 1, wherein the method further comprises one or more verifiers verifying the aggregated batch digest signature by computing the batch digest and an aggregated public key using public keys of the signers who contributed to obtaining the aggregated batch digest signature. ### Claim 12 (depends on 1) The method according to claim 1, wherein in order to verify respective signatures, respective identifiers are used to fetch respective public keys from a public key infrastructure. ### Claim 13 (depends on 1) The method according to claim 1, wherein the method further comprises the aggregator receiving a respective acknowledgement message for correct authentication of a respective payload from a respective verifier, and the aggregator sending a respective confirmation message for the correct authentication of the respective payload to the respective signer. ### Claim 14 (depends on 1) A non-transitory computer program product comprising instructions for implementing the steps of the method according to claim 1 when loaded and run on computing means of a computing device. ### Claim 15 A signature aggregator configured to perform operations, the operations comprising: receiving a set of first data packages from a set of signers, a respective first data package comprising a respective signer identifier, a respective payload, and a respective payload signature obtained by using a respective first secret key of a respective signer; verifying the payload signatures to determine whether or not the payloads are correctly signed; bundling a set of correctly signed payloads into a batch; obtaining a batch digest for the batch, and proofs of inclusion of the payloads in the batch; sending a respective second data package comprising the batch digest and a respective proof of inclusion to the respective signer, the respective proof of inclusion proving that the payload of the respective signer is included in the batch; receiving a set of third data packages from the set of signers, a respective third data package comprising the respective signer identifier, and a respective batch digest signature obtained by using a respective second secret key of the respective signer, the respective second secret key being from a signature scheme supporting aggregatable signatures; verifying the batch digest signatures to determine whether or not the batch digest is correctly signed by the set of signers; aggregating a set of correctly signed batch digest signatures to obtain an aggregated batch digest signature; and including the aggregated batch digest signature in the batch.