# Elliptic Curve digital signature algorithm without "hashing to point"?

Through " Why do we need to convert hashes to points on an elliptic curve? ", I found out why Hashing to Point is necessary.

However, using the algorithm below can sign and verify without Hasing to Point?

• $$a$$ is secret key
• $$H$$ is scalar hash function

Sign:

• $$k = random (mod\ r)$$
• $$r = kG_2$$
• $$s = a (H(m||r) + k)$$ : If don't know k, won't know a. Also hashing both m and r to prevent tamper.

Verify:

• $$e(G_1, sG_2) == e(aG_1, r + H(m||r)G_2)$$
• So $$e(G_1, G_2)^{a(H(m||r) + k)} == e(G_1, G_2)^{a(k + H(m||r))}$$

If these methods weren't used before, why would they?

Would that be more inefficient than finding a Point with a Hash?

Or maybe it's not safe?

• Many common Elliptic Curve digital signature algorithms (ECDSA, EdDSA…) do without "hashing to point". Therefore I have assumed that this question is about a variant of BLS signature, and re-tagged it accordingly, as I did for the previous one. This important fact about the context is worth being made explicit in the question.
– fgrieu
Commented Feb 13, 2023 at 13:52
• What is $random(mod\ r)$? Commented Feb 14, 2023 at 16:52
• It meant to generate random within the range of field r. In fact, mod is omitted after the first line. Commented Feb 14, 2023 at 22:20
• I'm just curious; what advantage would this have over, say, a Schnorr signature? It's larger, slower to generate, slower to verify (given that known pairing friendly curves are larger than standard curves of the same security strength) Commented Mar 2, 2023 at 2:21
• Pairing signatures are usually used because the signatures are smaller (1 group element). This is only possible because DDH is easy in pairing groups, which is how verification works at all. You need hash to curve so the input point discrete log is unknown (IE:random oracle chooses input point) otherwise there's no way to get a signature scheme that can sign an arbitrary number of messages. If you're willing to make the signatures larger (1 scalar or group element + 128 bits) then compact Schnorr signatures work with only "hash to scalar". Commented Jul 30, 2023 at 22:58

The reason that BLS signatures and their hash-to-curve approach are preferred is due to the signature size. A BLS signature can be represented using a single point of $$G_1$$ whereas your scheme requires both a point on $$G_2$$ and a scalar multiple (its a simple matter to make this a point on $$G_1$$ and a scalar, but this would still be several hundred bits larger than a BLS signature). There are also other useful features for BLS such as aggregated verification