Re: [Cfrg] BLS - proofs of possession may not be enough?

[Kobi Gurkan <[e-mail]>]

Hey Jeff,

Thanks for the comment, also in our one-to-one chat.

I think that the practical impact of the property that I describe are not catastrophic. Some comment I got recently was that it could been achieved just as well by publishing the secret keys.

Kobi

> On 17 Nov 2019, at 21:48, Jeff Burdges <[e-mail]> wrote:
> 
> 
> I’d still characterise sum_i sk_i = 0 as an unusual DGK that changes the properties of the signature similarly to any other DKG does.  In particular, any proof-of-possesion security proof should show this does not impact other signers under normal threat models.
> 
> As we discussed, there are threat models with non-standard interactions between signatures in which sum_i sk_i = 0 does facilitate attacks, namely when a signer waits for other signers and can be punished for signing too early.  I’ll note however that BLS cannot achieve security for that signer anyways because the earlier signers can subtract their signatures even without any relationship among the secret keys.
> 
>> On 17 Nov 2019, at 14:12, Kobi Gurkan <[e-mail]> wrote:
>> It seems that delinearization, as described in https://crypto.stanford.edu/~dabo/pubs/papers/BLSmultisig.html, is strictly stronger than proofs of possession in terms of security - as this attack does not effect protocols that use them.
> 
> I suspect it’s strictly stronger but actually nobody proved this.  An approach for showing that delinearization is stronger than proof-of-possesion might be working in some composability framework, but this gets delicate because classically these handle state poorly.
> 
> Jeff
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg