1
$\begingroup$

Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, namely it also knows some value $ v = g_1 \, sk \in \mathbb{G}_1 $? E.g. is the adversary able to forge signatures under $ sk $ or even able to obtain $ sk $?

Question B
If the answer to question A is that the scheme is still secure. How can I prove such a fact formally?

Definitions
$ \mathbb{G}_1 $, $ \mathbb{G}_2 $... elliptic curve groups of prime order $ q $
$ g_1 \in \mathbb{G}_1 $ and $ g_2 \in \mathbb{G}_2 $... generators of the groups $ \mathbb{G}_1 $, $ \mathbb{G}_2 $
$ e: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T $... an efficiently computable, bilinear and non-degenerable map (a pairing) $ H_1: \mathcal{M} \to \mathbb{G}_1 $... an hash function mapping messages elements from group $ \mathbb{G}_1 $

$ keygen() $... a probabilistic algorithm returning a private/public key pair $ \langle sk, pk \rangle $
with $ sk \in \mathbb{Z}_q $ and $ pk = sk \, g_2 \in \mathbb{G}_2 $

$ sign: \mathbb{Z}_q \times \mathcal{M} \to \mathbb{G}_1 $... the signing algorithm mapping the secret key $ sk $ and message $ m $ to a point in $ \mathbb{G}_1 $, i.e. $ sign_{sk}(m) = H_1(m) \, sk $

$ verify: \mathbb{G}_2 \times \mathcal{M} \times \mathbb{G}_1 \to \{ \textsf{valid}, \textsf{invalid} \} $... the signature verification algorithm taking the public key $ pk $, message $ m $ and signature $ \sigma $ and returning $ \textsf{valid} $ iff $ e(\sigma, g_2) = e(H_1(m), pk) $ holds

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.