Questions tagged [bls-signature]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
29 views

How do BLS signatures prove a private key belongs to public key

In a Boneh-Lynn-Shacham sig the public key: Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. ...
0
votes
1answer
49 views

Efficient Aggregate Signatures With Same Key

Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
5
votes
1answer
387 views

Compressing BLS signature with a hash function

It seems to me, that it should be possible to hash BLS signature to achieve significant space saving. Here is how it could work: Assuming we have a pairing-friendly elliptic curve with two generator ...
2
votes
0answers
87 views

Proof of membership in an aggregated BLS signature

Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given: $m_1...m_n$ are $n$ distinct messages $p_1...p_n$ are private keys with $P_1...P_n$ being ...
1
vote
0answers
93 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
2answers
135 views

Using the same private key to generate Schnorr and BLS signatures

I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
1
vote
1answer
136 views

BLS hash as a group element exponent?

In BLS short signatures paper, the authors describe a hash function $H\colon\ \{0, 1\}^∗ → G^∗$, where $G$ is a Gap-Diffie-Hellman group. They present a structure where a standard hash is used on a ...
1
vote
0answers
26 views

Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?

BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
2
votes
0answers
101 views

Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?

The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
2
votes
1answer
234 views

Is BLS signature scheme strongly unforgeable?

I would like to know if BLS signature scheme is strongly unforgeable under adaptive chosen message attack. If it is not, is it possible to modify the BLS scheme in order to reach this property ? ...
2
votes
1answer
357 views

What schemes support signature aggregation? [closed]

Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The ...
0
votes
1answer
296 views

Jpbc secure choice of elliptic curve

JPBC library describes 6 types of elliptic curves. This is how they describe type A: Type A pairings are constructed on the curve $y^2=x^3+x$ over the field $\mathbb{F}_q$ for some prime $q=3 \mod ...
1
vote
0answers
188 views

BLS aggregate signatures for relay node non-interactive incentive accounting

This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated. I'm looking for a low-bandwidth, non-interactive ...
1
vote
1answer
388 views

Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?

I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here. I am looking into implementing some operations for the BLS signature scheme in ...
5
votes
1answer
148 views

Standard parameters for Boneh–Lynn–Shacham signature?

The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature. Are there standard parameters for BLS signature, (being?) defined ...
6
votes
1answer
470 views

Elliptic curves with pairings at 128-bit security in libpbc?

I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
2
votes
0answers
240 views

BLS signature choice of generator

Studying the bls signatures, I am wondering how in practice should we handle the parameter G. In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
6
votes
1answer
2k views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
2
votes
0answers
135 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...