Suppose $g$ is a pairing-friendly elliptic curve with subgroup generators $G_1$ and $G_2$. Suppose also that $M$ is the message I want to sign.
Setup
- Compute $A = a \cdot G_1$ and $P = p \cdot G_2$, where $a$ and $p$ are some secret values.
- The public key is then defined as a tuple $(A, P)$.
Signature
- Hash message $M$ to a number using a hash function: $m=Hash(M)$.
- Compute $C = \frac{p}{a \cdot m} \cdot G_2$.
- The signature is then defined as $C$.
Verification
- Compute $m = Hash(M)$.
- Verify that $e(A, C)^m = e(G_1, P)$.
Are there any holes in this scheme?