5
$\begingroup$

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature.

Are there standard parameters for BLS signature, (being?) defined by standard bodies, security authorities, or other recognized authority; or otherwise common?

In particular, is there something in the upcoming ISO/IEC 15946-5 Information technology - Security techniques - Cryptographic techniques based on elliptic curves - Part 5: Elliptic curve generation?


Some references:

Dan Boneh, Ben Lynn, Hovav Shacham, Short Signatures from the Weil Pairing, in Journal of Cryptology, 2004, and proceedings of Asiacrypt 2001.

Paulo S. L. M. Barreto, Michael Naehrig, Pairing-Friendly Elliptic Curves of Prime Order, in proceedings of SAC 2005; slides.

Mike Scott, Hovav Shacham, Terence Spies, P1363 presentation of 2006/10 (less ancient sign of interest in a standard body identified so far).

Michael Naehrig, Ruben Niederhagen, Peter Schwabe, New software speed records for cryptographic pairings, in proceedings of Latincrypt 2010; software linked at referring page.

Diego F. Aranha, Paulo S. L. M. Barreto, Patrick Longa, Jefferson E. Ricardini, The Realm of the Pairings, in proceedings of SAC2013, with slides (reporting actual use since 2002).

$\endgroup$
1
$\begingroup$

As a pairing-based scheme, my guess would be that IEEE 1363.3 is your best bet, but I don't have access to it from this computer.

The best implementation that I know of for these things is BN448 that was presented at RealWorldCrypto 2018. The constants in their constants.go must have come from somewhere - not necessarily a standards body, but Brendan is a well-known and competent cryptographer.

$\endgroup$
  • $\begingroup$ The author of BN448 apparently introduced it so that it "should be closer to the 128-bit security level". How far are we from $b$-bit security for $2b$-bit signature? $\endgroup$ – fgrieu Apr 27 '18 at 1:22
  • 1
    $\begingroup$ It seems that originally BN256 was intended to offer 128-bit security, realising the $2b$ signatures, but then new attacks were found. The relevant link has an extra "." on the end causing an error, remove the final period and it works again. Or see a thread view of the discussion. $\endgroup$ – Bristol Apr 27 '18 at 6:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.