Efficient Aggregate Signatures With Same Key

Question

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs to Bob, who knows Alice's public key.

Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. ($\mathcal M, s')$, that validates with Alice's public key?

If I understand it correctly, this is achievable using BLS signatures, but I was wondering if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

Thanks in advance.

Answer 1

Can Bob, without interacting with Alice, generate a new aggregate signature for the entire message set, i.e. (M,s′), that validates with Alice's public key?

That would be troubling if Bob could sign anything verifiable by Alice's key (on behalf Alice).

if there is a simpler and more efficient method available if there is only one signer. I am mainly concerned with validation speed.

I am not sure if it's the most efficient way, however, I may disclose how it was done in reality. At one of the public sector publishers, the publisher is mandatory to digitally sign a set of publications and all their translations. So the system generates a new message consisting of a list of publications and their hashes and then the whole list is signed. However - in this case, the concern here was signing speed (so the signing person doesn't need to enter her PIN into HSM for every single publication).