Through " Why do we need to convert hashes to points on an elliptic curve? ", I found out why Hashing to Point is necessary.

However, using the algorithm below can sign and verify without Hasing to Point?

  • $a$ is secret key
  • $H$ is scalar hash function


  • $k = random (mod\ r)$
  • $r = kG_2$
  • $s = a (H(m||r) + k)$ : If don't know k, won't know a. Also hashing both m and r to prevent tamper.


  • $e(G_1, sG_2) == e(aG_1, r + H(m||r)G_2)$
  • So $e(G_1, G_2)^{a(H(m||r) + k)} == e(G_1, G_2)^{a(k + H(m||r))}$

If these methods weren't used before, why would they?

Would that be more inefficient than finding a Point with a Hash?

Or maybe it's not safe?

  • 4
    $\begingroup$ Many common Elliptic Curve digital signature algorithms (ECDSA, EdDSA…) do without "hashing to point". Therefore I have assumed that this question is about a variant of BLS signature, and re-tagged it accordingly, as I did for the previous one. This important fact about the context is worth being made explicit in the question. $\endgroup$
    – fgrieu
    Commented Feb 13, 2023 at 13:52
  • $\begingroup$ What is $random(mod\ r)$? $\endgroup$
    – Ievgeni
    Commented Feb 14, 2023 at 16:52
  • $\begingroup$ It meant to generate random within the range of field r. In fact, mod is omitted after the first line. $\endgroup$
    – user212942
    Commented Feb 14, 2023 at 22:20
  • $\begingroup$ I'm just curious; what advantage would this have over, say, a Schnorr signature? It's larger, slower to generate, slower to verify (given that known pairing friendly curves are larger than standard curves of the same security strength) $\endgroup$
    – poncho
    Commented Mar 2, 2023 at 2:21
  • $\begingroup$ Pairing signatures are usually used because the signatures are smaller (1 group element). This is only possible because DDH is easy in pairing groups, which is how verification works at all. You need hash to curve so the input point discrete log is unknown (IE:random oracle chooses input point) otherwise there's no way to get a signature scheme that can sign an arbitrary number of messages. If you're willing to make the signatures larger (1 scalar or group element + 128 bits) then compact Schnorr signatures work with only "hash to scalar". $\endgroup$ Commented Jul 30, 2023 at 22:58

1 Answer 1


This scheme feels similar to the Sakai-Kashara identity-based scheme and I can't immediately see a security issue.

The reason that BLS signatures and their hash-to-curve approach are preferred is due to the signature size. A BLS signature can be represented using a single point of $G_1$ whereas your scheme requires both a point on $G_2$ and a scalar multiple (its a simple matter to make this a point on $G_1$ and a scalar, but this would still be several hundred bits larger than a BLS signature). There are also other useful features for BLS such as aggregated verification

If one is not too worried about signature size and other bells and whistles, then it ECDSA and EdDSA signatures are generally considered a more efficient signature scheme than pairing-based schemes in terms of both signing and verification. They too do not use hash-to-point.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.