Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [bls-signature]

The Boneh-Lynn-Shacham Signature scheme is a scheme where multiple signatures can be combined into one and verified given a public key, the data to be verified and a single combined signature.

Filter by
Sorted by
Tagged with
2 votes
0 answers
48 views

Can signature be repurposed?

Given public key $pk$, message $M$ and its signature $\sigma$, is it possible to get another $pk'\not =pk$, $M'$ with the totally same signature $\sigma$? In other word, the following ones are both ...
Twiforest's user avatar
1 vote
0 answers
56 views

Creating a weak BLS

I am exploring the implementation of a cryptographic signature that users can manually input, and I am willing to compromise security to a level where a hacker investing several thousand dollars in ...
Ehsan's user avatar
  • 51
0 votes
0 answers
28 views

Look for a signature method similar to proxy resigning

The tag of a file is generated by the user's private key, which includes the file data, the file identifier and other contents. Is there any signature algorithm that can modify the file identifier ...
nan gan's user avatar
1 vote
1 answer
81 views

Hashing to the target group of bilinear pairing

Assuming we have fixed pairing friendly elliptic curve groups $G_1$, $G_2$ and $G_T$ where for $a \in G_1$ and $b \in G_T$ it holds $e(a,b) \in G_T$. Let's put some more context and we are working in ...
curious's user avatar
  • 6,180
0 votes
1 answer
103 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
nan gan's user avatar
1 vote
1 answer
62 views

Similar to Diffie Hellman for BLS in asymmetric pairing?

I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
Manish Adhikari's user avatar
1 vote
0 answers
44 views

What are the implications of BLS signature verification without checking the elements are in the prime subgroup?

Consider a BLS signature verification using BLS12-381 where signatures are in $G_1$ and public keys are in $G_2$. Verification is performed by checking that $e(sig, G2) = e(H(m), pk)$ or equivalently (...
Jack Lloyd's user avatar
  • 1,694
2 votes
1 answer
261 views

Encryption within the groups of BLS12-381

I have been investigating libraries that implement operations and protocols involving BLS12-381 curves. I have noticed an absence of libraries that support encryption over (either of) the groups G1 ...
884d88baaa's user avatar
1 vote
2 answers
133 views

How to redistribute shares for Distributed Shamir Secret Sharing?

I'm working on a Distributed Key Generation protocol. The idea is similar to this. TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
user106458's user avatar
2 votes
1 answer
82 views

Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?

​I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
X.H. Yue's user avatar
  • 370
3 votes
1 answer
136 views

Bilinear pairing for compact BLS signature

What family of bilinear pairing is recommendable for BLS signature when the overriding criteria is compactness of the signature, as desirable for something to be keyed-in from printout, or embedded in ...
fgrieu's user avatar
  • 142k
1 vote
0 answers
48 views

Please review proxy re-signature on Elliptic Curve [closed]

I want to implement proxy re-signature on elliptic curve. I've been thinking about ideas like the one below, but are there any problems? Key Generate: $a = $ alice's secret key $aG$ = alice's public ...
user212942's user avatar
2 votes
1 answer
285 views

Elliptic Curve digital signature algorithm without "hashing to point"?

Through " Why do we need to convert hashes to points on an elliptic curve? ", I found out why Hashing to Point is necessary. However, using the algorithm below can sign and verify without ...
user212942's user avatar
2 votes
2 answers
254 views

Why do we need to convert hashes to points on an elliptic curve?

In order to sign message m, m must be mapped to a point in G.1 However, Point can be multiplied. Why can't I simply do $mG$? Example: $pk = [sk]G_1$ $m = hash(message)$ Signing: $s = m [sk] G_2$ ...
user212942's user avatar
2 votes
1 answer
111 views

Modulus for reduction in BLS Signature Scheme

I'm currently working with BLS Signature Schemes in the field of publicly verifiable Compact Proofs of Retrievability by Shacham and Waters. So for creating the Sigmas the following function is ...
unsigned_int2's user avatar
3 votes
1 answer
440 views

BLS signature scheme with G_1 = G_2

The Wikipedia page for BLS digital signature describes a scheme with only two groups, $G$ and $G_T$, and a bilinear pairing $e: G \times G \rightarrow G_T$. To the best of my understanding, in such a ...
Matteo Monti's user avatar
  • 1,407
2 votes
0 answers
88 views

Create random element from group G in BLS Scheme

I hope this question is not too basic. I'm currently trying to implement compact proofs of retrievability that are publicly verifiable by BLS scheme as described in this paper Compact Proofs of ...
unsigned_int2's user avatar
5 votes
1 answer
1k views

What are the structural differences between BLS12-381 and BLS12-377?

What's the difference between BLS12-381 and BLS12-377? Previously I thought their basic cryptographic algorithms were same, so it's easy to construct BLS12-381 from BLS12-377, or construct BLS12-377 ...
Xing Chang's user avatar
1 vote
2 answers
91 views

Is it possible to show and hide certain values of a message and still able to very a BLS aggregated signature?

When using BLS, let's say Alice signs each of the 5 messages ($m_1, m_2, m_3, m_4, m_5$), aggregates the signatures and sends the aggregated signature to Bob. Bob can verify it. Here's the goal: ...
xenon's user avatar
  • 225
2 votes
1 answer
745 views

How does Ethereum BLS signature verification works?

I am implementing BLS signature verification on smart contracts and I have a question regarding the way that Ethereum verifies the signature. Recall that bls signature works as $e(P_2,H(m)_1)_T=e(G_2,...
blockByblock's user avatar
1 vote
0 answers
64 views

BLS Rogue attack: how does e(x^b, y)=e(x, y^b)? [duplicate]

In aggregated BLS Signatures, there's a known attack which allows an adversary to forge a valid signature for a message $m$ knowing only the victims public keys. Reading about the maths behind it, ...
joaquinlpereyra's user avatar
0 votes
0 answers
62 views

Decrypt aggregate signature scheme

I've learnt in the university course that using BLS, one can generate an aggregate signature using public keys of a given parties. We can then use a given party's public key to verify his ...
mele's user avatar
  • 1
0 votes
1 answer
36 views

How is BLS secure against adaptive selection message attacks when the message is known?

Maybe the below question is similar to what I was thinking, but I don't understand: Is BLS signature scheme strongly unforgeable? Below is the attack method I was thinking of. If know m, can't create ...
user212942's user avatar
4 votes
1 answer
939 views

How is a BLS Private Key generated? What are the different names for the parts?

relic, the library used by the majority of BLS implementations, is rather difficult to build cross-platform. Because of this, I've been looking for other pure BLS ...
coolaj86's user avatar
  • 193
1 vote
1 answer
224 views

Is BLS multi-signature aggregation separable?

In BLS multi-signature aggregation scheme we can combine different signatures of different peers into one single signature, and then we can verify whether the aggregated signature is truly signed by ...
Arian B's user avatar
  • 65
1 vote
1 answer
423 views

Isomorphic mapping of BLS12-381 G2 points to G1

I'm attempting to reproduce ring signatures as described in Section 5 of https://crypto.stanford.edu/~dabo/pubs/papers/aggreg.pdf but applied to the BLS12-381 system. One of the assumptions in their ...
David Rusu's user avatar
0 votes
1 answer
134 views

Notation question: Dividing 2 Elliptic Curve Points producing a third point

I'm working my way through some papers and ran across what seems to be division of two points that produce a third point. I'm new to ECC and am having a terrible time trying to figure out what this ...
David Rusu's user avatar
0 votes
1 answer
104 views

BLS to Schnorr signature conversion?

Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
Brqoo's user avatar
  • 103
1 vote
1 answer
527 views

Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
Martin's user avatar
  • 13
0 votes
1 answer
135 views

Message mapping to elliptic curve in BLS signature

In the BLS signature the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. The point $S$ is map (image) of $h(m)$ ...
Amirhnr's user avatar
  • 87
3 votes
1 answer
435 views

Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...
Amirhnr's user avatar
  • 87
0 votes
1 answer
794 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
bono_silhouette's user avatar
1 vote
1 answer
239 views

Can BLS aggregate signatures be merged?

In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures? For example, say you have two aggregate signatures, $...
dsharhon's user avatar
  • 123
2 votes
1 answer
563 views

Can we use BLS as a VRF?

Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first ...
Nikkolasg's user avatar
  • 204
0 votes
0 answers
54 views

Does BLS aggregating signatures allow duplicate signatures?

If there is a message $m_1$ that $H(m_1) \rightarrow g^r$ and there is another message $m_2$ that $H(m_2) \rightarrow g^k$, where $g^k$ is also a generator of $G$, is this possible? then $g^r$ could ...
Ray James's user avatar
0 votes
1 answer
101 views

Efficient Aggregate Signatures With Same Key

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
sbt's user avatar
  • 1
5 votes
1 answer
654 views

Compressing BLS signature with a hash function

It seems to me, that it should be possible to hash BLS signature to achieve significant space saving. Here is how it could work: Assuming we have a pairing-friendly elliptic curve with two generator ...
irakliy's user avatar
  • 969
6 votes
1 answer
371 views

Proof of membership in an aggregated BLS signature

Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given: $m_1...m_n$ are $n$ distinct messages $p_1...p_n$ are private keys with $P_1...P_n$ being ...
irakliy's user avatar
  • 969
1 vote
0 answers
142 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
raisyn's user avatar
  • 481
1 vote
2 answers
663 views

Using the same private key to generate Schnorr and BLS signatures

I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
irakliy's user avatar
  • 969
2 votes
1 answer
303 views

BLS hash as a group element exponent?

In BLS short signatures paper, the authors describe a hash function $H\colon\ \{0, 1\}^∗ → G^∗$, where $G$ is a Gap-Diffie-Hellman group. They present a structure where a standard hash is used on a ...
oleiba's user avatar
  • 377
2 votes
0 answers
61 views

Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?

BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
Saffie's user avatar
  • 131
4 votes
0 answers
235 views

Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?

The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
fgrieu's user avatar
  • 142k
2 votes
1 answer
633 views

Is BLS signature scheme strongly unforgeable?

I would like to know if BLS signature scheme is strongly unforgeable under adaptive chosen message attack. If it is not, is it possible to modify the BLS scheme in order to reach this property ? ...
thinker.92's user avatar
2 votes
1 answer
725 views

What schemes support signature aggregation? [closed]

Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The ...
Ilya Gazman's user avatar
0 votes
1 answer
463 views

Jpbc secure choice of elliptic curve

JPBC library describes 6 types of elliptic curves. This is how they describe type A: Type A pairings are constructed on the curve $y^2=x^3+x$ over the field $\mathbb{F}_q$ for some prime $q=3 \mod ...
Ilya Gazman's user avatar
1 vote
0 answers
245 views

BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
Richard Myers's user avatar
1 vote
1 answer
513 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ...
charleslu's user avatar
  • 111
9 votes
2 answers
1k views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature (perhaps: asymptotically). Are there standard parameters for BLS ...
fgrieu's user avatar
  • 142k
6 votes
1 answer
900 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
Alin Tomescu's user avatar
  • 1,003