# How is BLS secure against adaptive selection message attacks when the message is known?

Maybe the below question is similar to what I was thinking, but I don't understand: Is BLS signature scheme strongly unforgeable?

Below is the attack method I was thinking of. If know m, can't create a new signature from it?

• sk is secret key
• pk is public key
• m is message
• S is signature
• e(P, Q) : bilinear pairing

Sign : $$pk=sk \cdot P\\ S=sk \cdot m \cdot Q\\$$

Verify: $$e(P, S) = e(P, sk \cdot m \cdot Q) == e(pk, m \cdot Q) = e(sk \cdot P, m \cdot Q)\\ == e(P, Q)^{sk \cdot m}$$

Evil: $$S' = \frac{1}{m} \cdot m' \cdot S = m' \cdot sk\cdot Q$$

That is not how the Boneh-Lynn-Schacham scheme works. Instead, in your notation, the point $$S$$ is calculated by hashing a message $$m$$ to a point on the curve $$H(m)$$ (in a publicly known and verifiable way such as this draft RFC) and then multiplying by $$sk$$, thus: $$S=sk\cdot H(m).$$ Verification then checks that $$e(S,P)=e(H(m),pk).$$
Unless there is a a spectacularly bad choice of $$H$$, there should be no known scalar relationship between $$H(m)$$ and $$H(m')$$. Your attack needs $$H(m')=\frac{m'}mH(m)$$ which will not be true in general.