# Security of BLS under additional information on the secret key

Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $$pk = g_2 \, sk \in \mathbb{G}_2$$ also obtains additional information on the private key $$sk$$, namely it also knows some value $$v = g_1 \, sk \in \mathbb{G}_1$$? E.g. is the adversary able to forge signatures under $$sk$$ or even able to obtain $$sk$$?

Question B
If the answer to question A is that the scheme is still secure. How can I prove such a fact formally?

Definitions
$$\mathbb{G}_1$$, $$\mathbb{G}_2$$... elliptic curve groups of prime order $$q$$
$$g_1 \in \mathbb{G}_1$$ and $$g_2 \in \mathbb{G}_2$$... generators of the groups $$\mathbb{G}_1$$, $$\mathbb{G}_2$$
$$e: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$$... an efficiently computable, bilinear and non-degenerable map (a pairing) $$H_1: \mathcal{M} \to \mathbb{G}_1$$... an hash function mapping messages elements from group $$\mathbb{G}_1$$

$$keygen()$$... a probabilistic algorithm returning a private/public key pair $$\langle sk, pk \rangle$$
with $$sk \in \mathbb{Z}_q$$ and $$pk = sk \, g_2 \in \mathbb{G}_2$$

$$sign: \mathbb{Z}_q \times \mathcal{M} \to \mathbb{G}_1$$... the signing algorithm mapping the secret key $$sk$$ and message $$m$$ to a point in $$\mathbb{G}_1$$, i.e. $$sign_{sk}(m) = H_1(m) \, sk$$

$$verify: \mathbb{G}_2 \times \mathcal{M} \times \mathbb{G}_1 \to \{ \textsf{valid}, \textsf{invalid} \}$$... the signature verification algorithm taking the public key $$pk$$, message $$m$$ and signature $$\sigma$$ and returning $$\textsf{valid}$$ iff $$e(\sigma, g_2) = e(H_1(m), pk)$$ holds