Studying the bls signatures, I am wondering how in practice should we handle the parameter G.

In many signatures scheme, the generator used is a well known constant, for example eddsa with ed25519 has a well known fixed generator g. However, in the bls example from the C source code of the pbc library of Dan Boneh they generate a random G. In the literature they suppose the G is known by all parties. In jPBC sources , they save that system parameter G to a file.

Is there not a well defined constant G somewhere so client / signers don't have to exchange that value?

If I were to deploy a bls signature system, how would I chose this G? There does not seem to be any constraint over this system parameters since it's taken at random.

Do I include it in the signature and generate a new one for each signature? (providing more randomness at the expense of a bigger size?) or should I generate one element at random and call it G and make it public? Or save to a file and maybe have multiple files for different recipients ?

  • 1
    $\begingroup$ The only requirement is that G must be known to all parties. How exactly you implement that doesn't really matter. $\endgroup$ – fkraiem Oct 9 '16 at 20:31
  • $\begingroup$ Ok then I guess I should have directed my question more like: Is there a constant somewhere specifying what is a good base to take as a base point for generating BLS priv/pub key & signatures ? Such as ed25519 base point (stack question crypto.stackexchange.com/questions/27392/base-point-in-ed25519) $\endgroup$ – Nikkolasg Oct 10 '16 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.