0
$\begingroup$

Maybe the below question is similar to what I was thinking, but I don't understand: Is BLS signature scheme strongly unforgeable?

Below is the attack method I was thinking of. If know m, can't create a new signature from it?

  • sk is secret key
  • pk is public key
  • m is message
  • S is signature
  • e(P, Q) : bilinear pairing

Sign : $$ pk=sk \cdot P\\ S=sk \cdot m \cdot Q\\ $$

Verify: $$ e(P, S) = e(P, sk \cdot m \cdot Q) == e(pk, m \cdot Q) = e(sk \cdot P, m \cdot Q)\\ == e(P, Q)^{sk \cdot m} $$

Evil: $$ S' = \frac{1}{m} \cdot m' \cdot S = m' \cdot sk\cdot Q $$

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

That is not how the Boneh-Lynn-Schacham scheme works. Instead, in your notation, the point $S$ is calculated by hashing a message $m$ to a point on the curve $H(m)$ (in a publicly known and verifiable way such as this draft RFC) and then multiplying by $sk$, thus: $$S=sk\cdot H(m).$$ Verification then checks that $$e(S,P)=e(H(m),pk).$$

Unless there is a a spectacularly bad choice of $H$, there should be no known scalar relationship between $H(m)$ and $H(m')$. Your attack needs $H(m')=\frac{m'}mH(m)$ which will not be true in general.

Improve this answer
$\endgroup$
2
  • $\begingroup$ thank you! coingeek.com/… also worked for me. In short, is it correct to use points close to m in the curve group instead of using the generator point? And can define the found point as m'G, but my attack is impossible because it is difficult to find m' from the point? $\endgroup$
    – user212942
    Commented Jul 14, 2022 at 11:57
  • $\begingroup$ The notation and terminology is getting a little muddled, but I think that is correct. $\endgroup$
    – Daniel S
    Commented Jul 14, 2022 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.