Why can this adversary forge a BLS proof-of-possession signature?

Question

This paper RY07, section 4.3, gives an example of how proofs-of-possession can fail to prevent rogue keys in the context of the BMS multi-signature scheme (based on BLS signatures).

The attacker computes his rogue key as $D^* = \frac{g^{d'}}{D} = g^{d'-d}$, where $D$ is the public key of the honest co-signer. The attacker knows the secret key $d'$ but not the discrete log of his rogue key $D^*$, which is $d'-d$.

The paper describes the attacker invoking some magic oracle query $\text{OMSign}(D, D^*)$ to get a BLS signature $\sigma = H(D^*)^{d}$ - i.e. a signature on the attacker's rogue key $D^*$, issued by the honest signer's public key $D = g^d$.

The attacker can then compute a forged proof-of-possession $\pi$ as:

$$ \begin{align} \pi &= \frac{H(D^*)^{d'}}{\sigma} \\\\ &= \frac{H(D^*)^{d'}}{H(D^*)^{d}} \\\\ &= H(D^*)^{d'-d} \\\\ \end{align} $$

$\pi$ is then a valid BLS signature under the rogue key $D^* = g^{d'-d}$, and it will fool the receiver into believing the attacker knows $d'-d$.

But why does the attacker have access to this oracle $\text{OMSign}$? How would a real-world attacker convince an honest peer to sign $D'$?

Answer 1

The access to the $\mathrm{OMSign}$ resource is a common assumption in signature analysis, essentially corresponding to the most powerful adversary model in the Goldwasseer, Micali, Rivest hierarchy where the adversary can perform adaptive chosen message queries. The model does not concern itself with how such queries might be performed in practice.

On the other hand, various automated signing procedures in the real world have shown minimal message sanitisation procedures. For a good example of a real world forgery attack employed against an automated service, see the FLAME malware, where a signed message chosen by the attacker allowed a forged signature of a malicious payload via hash collision. It is attacks in this vein that the chosen message model seeks to prevent.