Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [bls-signature]

The tag has no usage guidance.

0
votes
1answer
41 views

Efficient Aggregate Signatures With Same Key

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
5
votes
1answer
331 views

Compressing BLS signature with a hash function

It seems to me, that it should be possible to hash BLS signature to achieve significant space saving. Here is how it could work: Assuming we have a pairing-friendly elliptic curve with two generator ...
2
votes
0answers
64 views

Proof of membership in an aggregated BLS signature

Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given: $m_1...m_n$ are $n$ distinct messages $p_1...p_n$ are private keys with $P_1...P_n$ being ...
1
vote
0answers
65 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
2answers
101 views

Using the same private key to generate Schnorr and BLS signatures

I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
1
vote
1answer
100 views

BLS hash as a group element exponent?

In BLS short signatures paper, the authors describe a hash function $H\colon\ \{0, 1\}^∗ → G^∗$, where $G$ is a Gap-Diffie-Hellman group. They present a structure where a standard hash is used on a ...
1
vote
0answers
22 views

Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?

BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
0
votes
0answers
25 views

How to assert that n distinct users have generate an aggregate signature?

If We have n users, each one generate message m1 and signs it to generate (σ1). then by using aggregate signature scheme, we get the aggregate signature of all messages m from n users. Is there a ...
3
votes
0answers
64 views

Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?

The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
2
votes
1answer
173 views

Is BLS signature scheme strongly unforgeable?

I would like to know if BLS signature scheme is strongly unforgeable under adaptive chosen message attack. If it is not, is it possible to modify the BLS scheme in order to reach this property ? ...
2
votes
1answer
245 views

What schemes support signature aggregation? [closed]

Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The ...
0
votes
1answer
228 views

Jpbc secure choice of elliptic curve

JPBC library describes 6 types of elliptic curves. This is how they describe type A: Type A pairings are constructed on the curve $y^2=x^3+x$ over the field $\mathbb{F}_q$ for some prime $q=3 \mod ...
1
vote
0answers
162 views

BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
1
vote
1answer
363 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ...
5
votes
1answer
128 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature. Are there standard parameters for BLS signature, (being?) defined ...
6
votes
1answer
384 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
0
votes
0answers
44 views

How to implement Full domain Hash Function [duplicate]

I am making a project using bilinear maps (ORUTA). It uses full domain hash function and is given by: $$H : \{0, 1\}^* \rightarrow \mathbb G_1 $$ Where $\mathbb G_1$ is a multiplicative cyclic group. ...
2
votes
0answers
201 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
7
votes
1answer
2k views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
2
votes
0answers
129 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...