In a Boneh-Lynn-Shacham sig the public key:

Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. We calculate an aggregated public key exactly the same way as before:

P = a1×P1+a2×P2+a3×P3, ai = hash(Pi, {P1,P2,P3})

The signature that key i is a member of the m of n sig:

MKi = (a1⋅pk1)×H(P, i)+(a2⋅pk2)×H(P, i)+(a3⋅pk3)×H(P, i)

which is an elliptic curve pairing signature of H(P,i),

e(G, MKi)=e(P, H(P,i))

To sign a message with 2 of 3:

S1 = pk1×H(P, m)+MK1, S3=pk3×H(P, m)+MK3

and add them up to obtain single signature and key:

(S’, P’) = (S1+S3, P1+P3)

And the verification is:

e(G, S’) = e(G, S1+S3)=e(G, pk1×H(P, m)+pk3×H(P, m)+MK1+MK3)

=e(G, pk1×H(P, m)+pk3×H(P, m))⋅e(G, MK1+MK3)

=e(pk1×G+pk3×G, H(P, m))⋅e(P,H(P, 1)+H(P, 3))=e(P’, H(P, m))⋅e(P, H(P, 1)+H(P, 3))

Where is the commitment that pk1 is a valid signature for P1? It seems to me that only the number i is committed to. For instance, use Mk1 and MK3 of the real keys, and compute S1 = pk_fake*H(P, m)+MK1, S3=pk3*H(P, m)+MK3 and calculate P'=P_fake + P3 and the signature checks out. If you change MKi to use H(P, ai) instead of H(P, i) I think this would be solved.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.