Questions tagged [bls-signature]

The Boneh-Lynn-Shacham Signature scheme is a scheme where multiple signatures can be combined into one and verified given a public key, the data to be verified and a single combined signature.

Filter by
Sorted by
Tagged with
2 votes
1 answer
41 views

How is a BLS Private Key generated? What are the different names for the parts?

relic, the library used by the majority of BLS implementations, is rather difficult to build cross-platform. Because of this, I've been looking for other pure BLS ...
user avatar
  • 151
0 votes
1 answer
34 views

Is BLS multi-signature aggregation separable?

In BLS multi-signature aggregation scheme we can combine different signatures of different peers into one single signature, and then we can verify whether the aggregated signature is truly signed by ...
user avatar
  • 45
1 vote
1 answer
75 views

Isomorphic mapping of BLS12-381 G2 points to G1

I'm attempting to reproduce ring signatures as described in Section 5 of https://crypto.stanford.edu/~dabo/pubs/papers/aggreg.pdf but applied to the BLS12-381 system. One of the assumptions in their ...
user avatar
0 votes
1 answer
106 views

Notation question: Dividing 2 Elliptic Curve Points producing a third point

I'm working my way through some papers and ran across what seems to be division of two points that produce a third point. I'm new to ECC and am having a terrible time trying to figure out what this ...
user avatar
0 votes
1 answer
54 views

BLS to Schnorr signature conversion?

Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
user avatar
  • 103
1 vote
1 answer
206 views

Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
user avatar
  • 13
0 votes
1 answer
89 views

Message mapping to elliptic curve in BLS signature

In the BLS signature the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. The point $S$ is map (image) of $h(m)$ ...
user avatar
  • 77
2 votes
1 answer
200 views

Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...
user avatar
  • 77
0 votes
0 answers
409 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
user avatar
0 votes
1 answer
138 views

Can BLS aggregate signatures be merged?

In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures? For example, say you have two aggregate signatures, $...
user avatar
  • 113
2 votes
1 answer
315 views

Can we use BLS as a VRF?

Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first ...
user avatar
  • 204
0 votes
0 answers
45 views

Does BLS aggregating signatures allow duplicate signatures?

If there is a message $m_1$ that $H(m_1) \rightarrow g^r$ and there is another message $m_2$ that $H(m_2) \rightarrow g^k$, where $g^k$ is also a generator of $G$, is this possible? then $g^r$ could ...
user avatar
0 votes
1 answer
76 views

Efficient Aggregate Signatures With Same Key

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
user avatar
  • 1
5 votes
1 answer
561 views

Compressing BLS signature with a hash function

It seems to me, that it should be possible to hash BLS signature to achieve significant space saving. Here is how it could work: Assuming we have a pairing-friendly elliptic curve with two generator ...
user avatar
  • 909
4 votes
0 answers
187 views

Proof of membership in an aggregated BLS signature

Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given: $m_1...m_n$ are $n$ distinct messages $p_1...p_n$ are private keys with $P_1...P_n$ being ...
user avatar
  • 909
1 vote
0 answers
139 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
user avatar
  • 461
1 vote
2 answers
482 views

Using the same private key to generate Schnorr and BLS signatures

I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
user avatar
  • 909
2 votes
1 answer
207 views

BLS hash as a group element exponent?

In BLS short signatures paper, the authors describe a hash function $H\colon\ \{0, 1\}^∗ → G^∗$, where $G$ is a Gap-Diffie-Hellman group. They present a structure where a standard hash is used on a ...
user avatar
  • 367
1 vote
0 answers
54 views

Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?

BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
user avatar
  • 21
3 votes
0 answers
185 views

Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?

The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
user avatar
  • 122k
2 votes
1 answer
437 views

Is BLS signature scheme strongly unforgeable?

I would like to know if BLS signature scheme is strongly unforgeable under adaptive chosen message attack. If it is not, is it possible to modify the BLS scheme in order to reach this property ? ...
user avatar
2 votes
1 answer
696 views

What schemes support signature aggregation? [closed]

Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The ...
user avatar
0 votes
1 answer
406 views

Jpbc secure choice of elliptic curve

JPBC library describes 6 types of elliptic curves. This is how they describe type A: Type A pairings are constructed on the curve $y^2=x^3+x$ over the field $\mathbb{F}_q$ for some prime $q=3 \mod ...
user avatar
1 vote
0 answers
241 views

BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
user avatar
1 vote
1 answer
464 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ...
user avatar
  • 111
8 votes
2 answers
565 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature (perhaps: asymptotically). Are there standard parameters for BLS ...
user avatar
  • 122k
6 votes
1 answer
804 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
user avatar
2 votes
0 answers
303 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
user avatar
  • 204
4 votes
2 answers
633 views

Performance comparison between ECDSA and BLS signature schemes

I want to choose an efficient signature scheme for implementation on a lightweight MCU. I was wondering how does the performance of ECDSA and BLS signature schemes compare in terms of signing time and ...
user avatar
6 votes
1 answer
3k views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
user avatar
  • 3,397
2 votes
0 answers
156 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
user avatar