Given public key $pk$, message $M$ and its signature $\sigma$, is it possible to get another $pk'\not =pk$, $M'$ with the totally same signature $\sigma$? In other word, the following ones are both satisfied: verifySig$(pk,M,\sigma)=1$ and verifySig$(pk',M',\sigma)=1$.

I am uncertain whether all signature schemes possess this property. Specifically, does the BLS signature scheme exhibit this behavior, and if so, how can it be proven?

  • $\begingroup$ The security property discussed is definitely not part of he standard definition of signature, and not given by some signature schemes. This is discussed here, but not for BLS signature. If the question is BLS-specific, I recommend to add that in the title. $\endgroup$
    – fgrieu
    Mar 28 at 9:21
  • $\begingroup$ For BLS in GDH group you can do this and it will be equivalent to solving the discrete log problem, if you choose hash of message. If you would like to choose public key it would be simple calculation. You can not choose both. $\endgroup$
    – madhurkant
    Mar 28 at 11:08


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.