I would like to know if BLS signature scheme is strongly unforgeable under adaptive chosen message attack. If it is not, is it possible to modify the BLS scheme in order to reach this property ?
Thank you in advance.
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
BLS signatures are computed by hashing the message $m$ from the message space $\mathcal{M}$ to a source group of a bilinear pairing $e: \mathbb{G} \times \mathbb{G} \to \mathbb{G}_T$ using a hash function $H: \mathcal{M} \to \mathbb{G}$ and exponentiating $h$ with the secret key $x$, i.e., a signature $\sigma$ is of the form $$\sigma := H(m)^x.$$
The hash function maps each message to a uniquely determined value (there could be multiple messages which are mapped to the same value), and $x$ is fixed by the public key $g^x$. This means that BLS signatures are even unique. That is there is only one signature for each message. This is an even stronger property than unforgeability, i.e., every existentially unforgeable and unique signature scheme is also strongly existentially unforgeable.
For more details, one could refer to Hovav Shacham's PhD Thesis (one of the inventors of BLS signatures). He also argues that he does not further consider strong unforgeability, as the schemes presented in his thesis (including BLS signatures) are all unique (cf. Page 19 before Definition 3.2.1).
-
$\begingroup$ Thank you for your prompt replay. However can you provide to me a paper in which there is the proof ? Thank you in advance. $\endgroup$ Commented Mar 9, 2018 at 17:01
-
$\begingroup$ My argumentation above could essentially already be viewed as a proof. However, you could, for example, have a look at the paragraph on Page 19 before Defn 3.2.1. in Hovav Shacham's PhD Thesis (one of the inventors of BLS signatures). He argues that he does not further consider strong unforgeability, as the schemes presented in his thesis (including BLS signatures) are all unique. $\endgroup$– dadeCommented Mar 9, 2018 at 17:14
-
$\begingroup$ Thank you, for completeness can you edit the answer with this link? Then I'll select your answer as best answer :) $\endgroup$ Commented Mar 9, 2018 at 17:30