0
$\begingroup$

In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures?

For example, say you have two aggregate signatures, $X = a + b + c$ and $Y = b + c + d$, and the (unique) public keys and messages for individual signatures $a$ through $d$, but not the individual signatures anymore.

Can you make a "merged" aggregate signature $Z = a + b + c + d$?

Can you make a "combined" aggregate signature $W = a + 2b + 2c + d$ that can still be verified, perhaps by keeping track of the individual multipliers?

Improve this question
$\endgroup$
1
$\begingroup$

You cannot create a verifiable $Z$ but you can create a verifiable $W$ but you have to add public keys multiple times as well. So $W$ can be verified using a key $PK_a + 2*PK_b + 2*PK_c + PK_d$ if you had the same message or doing having multiple pairings for each repeated key in case of distinct messages

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks! (My upvote doesn't show up because my reputation score is too low.) $\endgroup$
    – Dylan
    Jan 26 '20 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.