2
$\begingroup$

I want to know if there is a multisignature scheme that allows the merging of two multisignatures for the same data but by two different sets of users, and without knowing the corresponding private keys. The goal is to obtain a single multisig that has the same size than the two multisigs it originates from.

This would be useful to construct certificates in a network of users. For example, two distinct sets of 10 users both sign the message $m$ and produce two multisignatures, $s_1$ and $s_2$. Another user, which has not signed $m$ yet, receives $s_1$ and $s_2$ and wants to merge them together before adding his signature to the resulting multisig. Is there a cryptosystem that allows that?

The only multisignature scheme I know of is based on RSA, but it does not allow what I want: the only way to merge $s_1$ and $s_2$ with this technique is for all signers to contribute to one of these multisigs.

Thank you for your help.

Improve this question
$\endgroup$

2 Answers 2

Reset to default
3
$\begingroup$

This kind of scheme exists and usually is called signature aggregation. One example is BLS (see https://crypto.stanford.edu/~dabo/pubs/papers/BLSmultisig.html)

BLS is nice because it's non interactive. You simply take the product of the individual signatures and that becomes the aggregate signature under an aggregate public key.

Improve this answer
$\endgroup$
2
  • $\begingroup$ This is nice, but in my case all users sign the same message so I reckon that I am exposed to rogue public key attacks. As it is notoriously discouraged to implement a crypto library by oneself, this BLS12-381 implementation in Rust caught my eye, however it is said nowhere in this project if this implementation mitigates the rogue public key attack. Ideally, I would like an implementation that uses the new technique against rogue public key attacks that is talked about in the page you linked. $\endgroup$
    – JacopoStanchi
    Commented Aug 12, 2022 at 9:32
  • $\begingroup$ Haven't checked in detail myself but the BDN signature fixes the rogue public key attack. See code here github.com/dedis/kyber/blob/master/sign/bdn/bdn.go and references in the comments $\endgroup$
    – lamba
    Commented Aug 12, 2022 at 10:02
0
$\begingroup$

I think it's what you need https://link.springer.com/chapter/10.1007/978-3-642-40041-4_27 《Full Domain Hash from (Leveled) Multilinear Maps and Identity-Based Aggregate Signatures》 the aggregate algorithm

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.