0
$\begingroup$

In a Boneh-Lynn-Shacham sig the public key:

Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. We calculate an aggregated public key exactly the same way as before:

P = a1×P1+a2×P2+a3×P3, ai = hash(Pi, {P1,P2,P3})

The signature that key i is a member of the m of n sig:

MKi = (a1⋅pk1)×H(P, i)+(a2⋅pk2)×H(P, i)+(a3⋅pk3)×H(P, i)

which is an elliptic curve pairing signature of H(P,i),

e(G, MKi)=e(P, H(P,i))

To sign a message with 2 of 3:

S1 = pk1×H(P, m)+MK1, S3=pk3×H(P, m)+MK3

and add them up to obtain single signature and key:

(S’, P’) = (S1+S3, P1+P3)

And the verification is:

e(G, S’) = e(G, S1+S3)=e(G, pk1×H(P, m)+pk3×H(P, m)+MK1+MK3)

=e(G, pk1×H(P, m)+pk3×H(P, m))⋅e(G, MK1+MK3)

=e(pk1×G+pk3×G, H(P, m))⋅e(P,H(P, 1)+H(P, 3))=e(P’, H(P, m))⋅e(P, H(P, 1)+H(P, 3))

Where is the commitment that pk1 is a valid signature for P1? It seems to me that only the number i is committed to. For instance, use Mk1 and MK3 of the real keys, and compute S1 = pk_fake*H(P, m)+MK1, S3=pk3*H(P, m)+MK3 and calculate P'=P_fake + P3 and the signature checks out. If you change MKi to use H(P, ai) instead of H(P, i) I think this would be solved.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.