Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, namely it also knows some value $ v = g_1 \, sk \in \mathbb{G}_1 $? E.g. is the adversary able to forge signatures under $ sk $ or even able to obtain $ sk $?

Question B
If the answer to question A is that the scheme is still secure. How can I prove such a fact formally?

Definitions
$ \mathbb{G}_1 $, $ \mathbb{G}_2 $... elliptic curve groups of prime order $ q $
$ g_1 \in \mathbb{G}_1 $ and $ g_2 \in \mathbb{G}_2 $... generators of the groups $ \mathbb{G}_1 $, $ \mathbb{G}_2 $
$ e: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T $... an efficiently computable, bilinear and non-degenerable map (a pairing) $ H_1: \mathcal{M} \to \mathbb{G}_1 $... an hash function mapping messages elements from group $ \mathbb{G}_1 $

$ keygen() $... a probabilistic algorithm returning a private/public key pair $ \langle sk, pk \rangle $
with $ sk \in \mathbb{Z}_q $ and $ pk = sk \, g_2 \in \mathbb{G}_2 $

$ sign: \mathbb{Z}_q \times \mathcal{M} \to \mathbb{G}_1 $... the signing algorithm mapping the secret key $ sk $ and message $ m $ to a point in $ \mathbb{G}_1 $, i.e. $ sign_{sk}(m) = H_1(m) \, sk $

$ verify: \mathbb{G}_2 \times \mathcal{M} \times \mathbb{G}_1 \to \{ \textsf{valid}, \textsf{invalid} \} $... the signature verification algorithm taking the public key $ pk $, message $ m $ and signature $ \sigma $ and returning $ \textsf{valid} $ iff $ e(\sigma, g_2) = e(H_1(m), pk) $ holds

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.