A signature is σ = sk·H(m), where H hashes the message to a curve point (RFC 9380), and verification checks the pairing equation e(σ, g) = e(H(m), pk). Signatures on any messages can be added into one point; verifying an aggregate costs one pairing per distinct message plus one. On BLS12-381 the "minimal public key" variant used by Ethereum has 48-byte public keys and 96-byte signatures; the "minimal signature" variant swaps the groups.
The scheme is specified in the IRTF CFRG Internet-Draft draft-irtf-cfrg-bls-signature; Ethereum's consensus layer (since the Beacon Chain launched on 1 December 2020) uses the ciphersuite BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_. Aggregating signatures on the same message needs a proof of possession for each key to stop rogue-key attacks. Other users include Filecoin, Chia and the drand randomness beacon, which relies on threshold BLS.
BLS is not in any NIST standard, verification costs about two pairings (milliseconds rather than microseconds), and like all pairing-based cryptography it is broken by Shor's algorithm.