Questions tagged [bls-signature]
The Boneh-Lynn-Shacham Signature scheme is a scheme where multiple signatures can be combined into one and verified given a public key, the data to be verified and a single combined signature.
48
questions
1
vote
0
answers
27
views
What are the implications of BLS signature verification without checking the elements are in the prime subgroup?
Consider a BLS signature verification using BLS12-381 where signatures are in $G_1$ and public keys are in $G_2$. Verification is performed by checking that
$e(sig, G2) = e(H(m), pk)$
or equivalently (...
- 1,704
2
votes
1
answer
150
views
Encryption within the groups of BLS12-381
I have been investigating libraries that implement operations and protocols involving BLS12-381 curves. I have noticed an absence of libraries that support encryption over (either of) the groups G1 ...
- 73
1
vote
2
answers
66
views
How to redistribute shares for Distributed Shamir Secret Sharing?
I'm working on a Distributed Key Generation protocol. The idea is similar to this.
TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
- 111
2
votes
1
answer
56
views
Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?
I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
- 368
3
votes
1
answer
120
views
Bilinear pairing for compact BLS signature
What family of bilinear pairing is recommendable for BLS signature when the overriding criteria is compactness of the signature, as desirable for something to be keyed-in from printout, or embedded in ...
- 138k
1
vote
0
answers
46
views
Please review proxy re-signature on Elliptic Curve [closed]
I want to implement proxy re-signature on elliptic curve.
I've been thinking about ideas like the one below, but are there any problems?
Key Generate:
$a = $ alice's secret key
$aG$ = alice's public ...
- 109
2
votes
1
answer
207
views
Elliptic Curve digital signature algorithm without "hashing to point"?
Through " Why do we need to convert hashes to points on an elliptic curve? ", I found out why Hashing to Point is necessary.
However, using the algorithm below can sign and verify without ...
- 109
2
votes
2
answers
233
views
Why do we need to convert hashes to points on an elliptic curve?
In order to sign message m, m must be mapped to a point in G.1
However, Point can be multiplied. Why can't I simply do $mG$?
Example:
$pk = [sk]G_1$
$m = hash(message)$
Signing: $s = m [sk] G_2$
...
- 109
2
votes
1
answer
101
views
Modulus for reduction in BLS Signature Scheme
I'm currently working with BLS Signature Schemes in the field of publicly verifiable Compact Proofs of Retrievability by Shacham and Waters.
So for creating the Sigmas the following function is ...
- 75
3
votes
1
answer
325
views
BLS signature scheme with G_1 = G_2
The Wikipedia page for BLS digital signature describes a scheme with only two groups, $G$ and $G_T$, and a bilinear pairing $e: G \times G \rightarrow G_T$. To the best of my understanding, in such a ...
- 1,375
2
votes
0
answers
84
views
Create random element from group G in BLS Scheme
I hope this question is not too basic. I'm currently trying to implement compact proofs of retrievability that are publicly verifiable by BLS scheme as described in this paper Compact Proofs of ...
- 75
5
votes
1
answer
837
views
What are the structural differences between BLS12-381 and BLS12-377?
What's the difference between BLS12-381 and BLS12-377?
Previously I thought their basic cryptographic algorithms were same, so it's easy to construct BLS12-381 from BLS12-377, or construct BLS12-377 ...
- 53
1
vote
2
answers
86
views
Is it possible to show and hide certain values of a message and still able to very a BLS aggregated signature?
When using BLS, let's say Alice signs each of the 5 messages ($m_1, m_2, m_3, m_4, m_5$), aggregates the signatures and sends the aggregated signature to Bob. Bob can verify it.
Here's the goal:
...
- 225
1
vote
1
answer
642
views
How does Ethereum BLS signature verification works?
I am implementing BLS signature verification on smart contracts and I have a question regarding the way that Ethereum verifies the signature. Recall that bls signature works as
$e(P_2,H(m)_1)_T=e(G_2,...
- 229
1
vote
0
answers
64
views
BLS Rogue attack: how does e(x^b, y)=e(x, y^b)? [duplicate]
In aggregated BLS Signatures, there's a known attack which allows an adversary to forge a valid signature for a message $m$ knowing only the victims public keys.
Reading about the maths behind it, ...
- 111
0
votes
0
answers
59
views
Decrypt aggregate signature scheme
I've learnt in the university course that using BLS, one can generate an aggregate signature using public keys of a given parties. We can then use a given party's public key to verify his ...
- 1
0
votes
1
answer
32
views
How is BLS secure against adaptive selection message attacks when the message is known?
Maybe the below question is similar to what I was thinking, but I don't understand:
Is BLS signature scheme strongly unforgeable?
Below is the attack method I was thinking of. If know m, can't create ...
- 109
4
votes
1
answer
673
views
How is a BLS Private Key generated? What are the different names for the parts?
relic, the library used by the majority of BLS implementations, is rather difficult to build cross-platform.
Because of this, I've been looking for other pure BLS ...
- 183
1
vote
1
answer
167
views
Is BLS multi-signature aggregation separable?
In BLS multi-signature aggregation scheme we can combine different signatures of different peers into one single signature, and then we can verify whether the aggregated signature is truly signed by ...
- 65
1
vote
1
answer
300
views
Isomorphic mapping of BLS12-381 G2 points to G1
I'm attempting to reproduce ring signatures as described in Section 5 of https://crypto.stanford.edu/~dabo/pubs/papers/aggreg.pdf but applied to the BLS12-381 system.
One of the assumptions in their ...
- 15
0
votes
1
answer
130
views
Notation question: Dividing 2 Elliptic Curve Points producing a third point
I'm working my way through some papers and ran across what seems to be division of two points that produce a third point. I'm new to ECC and am having a terrible time trying to figure out what this ...
- 15
0
votes
1
answer
90
views
BLS to Schnorr signature conversion?
Imagine a situation where a prover can only sign with BLS signature signing algorithm, a verifier can only verify with Schnorr signature verification algorithm. Is it possible to convert a BLS ...
- 103
1
vote
1
answer
468
views
Can you use ECDSA on pairing-friendly curves?
I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
- 13
0
votes
1
answer
128
views
Message mapping to elliptic curve in BLS signature
In the BLS signature the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. The point $S$ is map (image) of $h(m)$ ...
- 87
3
votes
1
answer
389
views
Mapping the hash of message to a point of elliptic curve for signature
Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...
- 87
0
votes
1
answer
699
views
Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons
As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
1
vote
1
answer
222
views
Can BLS aggregate signatures be merged?
In some non-interactive, pairing-friendly signature scheme, such as BLS12-381, is it possible to merge partially-overlapping aggregate signatures?
For example, say you have two aggregate signatures, $...
- 123
2
votes
1
answer
493
views
Can we use BLS as a VRF?
Intuitively, it seems that the hash of a BLS signature could be used as a VRF as well. In a nutshell, BLS-Signature is the VRF output and the verification first ...
- 204
0
votes
0
answers
50
views
Does BLS aggregating signatures allow duplicate signatures?
If there is a message $m_1$ that $H(m_1) \rightarrow g^r$
and there is another message $m_2$ that $H(m_2) \rightarrow g^k$, where $g^k$ is also a generator of $G$, is this possible?
then $g^r$ could ...
- 45
0
votes
1
answer
93
views
Efficient Aggregate Signatures With Same Key
Suppose Alice has a set of messages $\mathcal M$ and generates signature pairs for each message $(m_1,s_1)$, $(m_2,s_2)$, ... $(m_n,s_n)$ using the same key. She then transfers these signature pairs ...
- 1
5
votes
1
answer
639
views
Compressing BLS signature with a hash function
It seems to me, that it should be possible to hash BLS signature to achieve significant space saving. Here is how it could work:
Assuming we have a pairing-friendly elliptic curve with two generator ...
- 969
6
votes
1
answer
342
views
Proof of membership in an aggregated BLS signature
Is it possible to prove that a given signature is a part of an aggregated BLS signature? Specifically, given:
$m_1...m_n$ are $n$ distinct messages
$p_1...p_n$ are private keys with $P_1...P_n$ being ...
- 969
1
vote
0
answers
142
views
Security of BLS under additional information on the secret key
Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
- 481
1
vote
2
answers
639
views
Using the same private key to generate Schnorr and BLS signatures
I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
- 969
2
votes
1
answer
278
views
BLS hash as a group element exponent?
In BLS short signatures paper, the authors describe a hash function $H\colon\ \{0, 1\}^∗ → G^∗$, where $G$ is a Gap-Diffie-Hellman group.
They present a structure where a standard hash is used on a ...
- 377
2
votes
0
answers
57
views
Can the precompiles in Byzantium for pairings be used for implementation of BGLS verification?
BGLS [1] is an aggregate signature scheme by Boneh et al., that allows aggregation of BLS signatures on n different messages from n different signers. What I want to achieve is to verify such ...
- 131
3
votes
0
answers
218
views
Is BLS signature still conjectured to achieve $b$-bit security for $2b$-bit appendix?
The BLS signature scheme [1] promised $b$-bit security for signature with a $2b$-bit appendix, under classical hypothesis leaving aside the possibility of Quantum Computers usable for cryptanalysis. ...
- 138k
2
votes
1
answer
572
views
Is BLS signature scheme strongly unforgeable?
I would like to know if BLS signature scheme is strongly unforgeable under adaptive chosen message attack. If it is not, is it possible to modify the BLS scheme in order to reach this property ?
...
- 137
2
votes
1
answer
717
views
What schemes support signature aggregation? [closed]
Definition: Signature aggregation is taking $n$ signatures of $n$ distinct messages and aggregate them into one short signature that has the same length range as the rest of the signatures. The ...
- 133
0
votes
1
answer
448
views
Jpbc secure choice of elliptic curve
JPBC library describes 6 types of elliptic curves. This is how they describe type A:
Type A pairings are constructed on the curve $y^2=x^3+x$ over the field $\mathbb{F}_q$ for some prime $q=3 \mod ...
- 133
1
vote
0
answers
243
views
BLS aggregate signatures for relay node non-interactive incentive accounting
This is a practical application of cryptography question and I hope this is the right place to ask it. Any advice would be very much appreciated.
I'm looking for a low-bandwidth, non-interactive ...
1
vote
1
answer
503
views
Can the precompiles in Ethereum Byzantium for pairings be used for implementation of BLS verification?
I asked this in the Ethereum StackExchange yesterday but I figured it would be more appropriate to ask it here.
I am looking into implementing some operations for the BLS signature scheme in ...
- 111
9
votes
2
answers
934
views
Standard parameters for Boneh–Lynn–Shacham signature?
The Boneh–Lynn–Shacham signature is (as far as I know) unrivaled in compactness, promising $b$-bit security for $2b$-bit signature (perhaps: asymptotically).
Are there standard parameters for BLS ...
- 138k
6
votes
1
answer
888
views
Elliptic curves with pairings at 128-bit security in libpbc?
I am using Ben Lynn's libpbc to implement a BLS threshold signature scheme and I am aiming for 128-bit security (i.e., a forgery attack should take around $2^{128}$ ...
- 1,003
2
votes
0
answers
343
views
BLS signature choice of generator
Studying the bls signatures, I am wondering how in practice should we handle the parameter G.
In many signatures scheme, the generator used is a well known constant, for example eddsa with ...
- 204
5
votes
2
answers
1k
views
Performance comparison between ECDSA and BLS signature schemes
I want to choose an efficient signature scheme for implementation on a lightweight MCU. I was wondering how does the performance of ECDSA and BLS signature schemes compare in terms of signing time and ...
6
votes
1
answer
3k
views
How does Boneh–Lynn–Shacham work?
As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
- 3,635
2
votes
0
answers
163
views
BLS signatures in the G-valued Random Oracle Model
This paper on semi-generic algorithms considers
"non-standard properties of the employed hash function".
For BLS signatures whose main group is $G$, I'm curious what can
be shown when the hash ...
user991